PWNING CLAUDE CODE IN 8 DIFFERENT WAYS

Summary from the TLDR InfoSec newsletter

Claude Code was found to execute arbitrary system commands without explicit user approval through eight distinct techniques that bypassed its command-safety mechanisms. These issues stemmed from fragile regex-based blocklists on “safe” commands like man, sort, sed, git, xargs, and rg, plus subtle Bash variable expansion tricks that hid real payloads. An attacker could turn supposedly read‑only operations into command execution paths by abusing lesser-known flags and prompt-like variable expansion. The problems were ultimately fixed by moving from a blocklist-first design to a stricter allowlist model in Claude Code v1.0.93.