Tego AI Reveals Second Security Issue in Claude Software

Tel Aviv, Israel, July 24th, 2026, CyberNewswire — Tego AI, a cybersecurity firm, has disclosed a second vulnerability within a week in Anthropic’s Claude ecosystem, focusing this time on the Claude Code tool. This disclosure follows a previous revelation about a flaw in the Claude Tag Slack integration.

The issue arises when Claude Code, a command-line coding tool, processes an external file without user awareness. This can occur when a repository is cloned, and Claude Code is initiated, leading to the automatic inclusion of an external file in the model’s initial request.

How the Vulnerability Works

The exploitation method is straightforward. By committing a file named CLAUDE.md, containing an @import directive that points to a symbolic link, developers can inadvertently expose external files. Upon cloning the repository and launching Claude Code, the tool follows the symbolic link to the specified file, incorporating its contents into the initial request made to the model, without triggering any alerts or requiring user approval.

This occurs because Claude Code’s security checks focus on in-repository links rather than the external files they may resolve to. Consequently, the contents of the external file become part of an outbound request, leaving the user’s system without their explicit consent.

Security Implications and Previous Fixes

Tego AI emphasizes the importance of this discovery due to its potential security implications. Similar flaws were previously identified and resolved in Claude Code under CVE-2025-59829 and CVE-2026-25724. However, this new report highlights that another code path, the startup memory loader, remains vulnerable, allowing unauthorized file access before any model actions.

Anthropic has recognized the issue but maintains that their security model, which relies on the ‘trust this folder’ prompt, is intact. This model assumes that accepting the prompt grants extensive permissions, aligning with their threat model.

Industry Response and Future Considerations

Tego AI’s disclosure is part of a broader discussion on security boundaries within AI tools. The company argues that the current model places excessive trust on a single user action, which might not sufficiently differentiate between benign and malicious operations.

Anthropic’s rationale for closing the report as ‘Informative’ reflects their consistent application of the security model. However, Tego AI stresses the need for enterprises to carefully evaluate these boundaries as AI coding agents become more prevalent.

Symbolic link attacks are not new, but Tego AI’s findings urge users and security teams to reassess the implications of granting trust to repository folders. The complete technical report is available for further insights.

About Tego AI

Tego AI specializes in cybersecurity for enterprise AI agents, focusing on runtime security and control. Their platform aims to prevent unauthorized actions by monitoring agent activities before accessing sensitive resources. Operating in stealth, Tego AI continues to reveal significant security issues, with more disclosures anticipated.