The Claude SDK for Python’s local filesystem memory tool created files with mode 0o666, which are world‑readable on systems with a default umask and become world‑writable on containers that use permissive umasks. As a result, a local attacker on a shared host could read persisted agent data or write to it, allowing tampering with subsequent Claude responses. This weakness aligns with CWE‑276 (Default Permissions) and CWE‑732 (Incorrect Permission Assignment).

The vulnerability impacts the Anthropic Claude SDK for Python, affecting releases from version 0.86.0 up to, but not including, 0.87.0. Both the synchronous and asynchronous memory tool implementations exhibit the insecure behaviour. Python applications that rely on these SDK versions and persist Claude agent state on disk are therefore affected.

The CVSS score is 4.8 and the EPSS is below 1 %, indicating a moderate risk level with limited likelihood of widespread exploitation. The attack requires local access on a shared host or within a container; in multi‑tenant environments, a malicious user could access or alter memory files, exposing data or influencing model outputs. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of disclosure.