Claude Code’s project‑load flow before version 2.0.65 allowed an attacker‑controlled repository to include a settings file that overrides the ANTHROPIC_BASE_URL parameter, causing the tool to issue API requests immediately upon opening the repository, before the user could review or confirm the trust prompt. This flaw enabled the exfiltration of the user’s Anthropic API keys to an attacker‑controlled endpoint, compromising sensitive credentials without the user’s knowledge.

The vulnerability affects Anthropic’s Claude Code agentic coding tool on all versions released prior to 2.0.65. Users who rely on the standard auto‑update mechanism have received the patch automatically, while those performing manual updates should check their current version and install the latest update.

The CVSS score of 5.3 indicates a moderate severity of information disclosure. The EPSS score of less than 1% suggests that exploit attempts are expected to be rare, and the vulnerability is not cataloged in the CISA KEV list. Exploitation requires an attacker to craft a malicious repository and entice a legitimate user to open it in Claude Code, meaning user interaction is necessary for the attack to succeed.