The Claude SDK for Python contains a flaw in its local filesystem memory tool that creates files with permissive permissions, allowing any local user on a shared host to read or modify the persisted agent state. The issue arises because files are created with mode 0o666, making them world‑readable or world‑writable when the system's umask is permissive, such as in many Docker images. An attacker who can execute code within the same host or container can exploit this to gain unauthorized access to sensitive data or influence future model interactions. The weakness corresponds to incorrect permissions and missing authorization in privileged operations, reflected in CWE‑276 and CWE‑732.

The vulnerability affects the Anthropic Python SDK for version 0.86.0 through any release prior to 0.87.0. These versions were released by Anthropics. The fix is available in version 0.87.0 and later.

The CVSS score is 4.8, which is a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who has a user account on a shared host or anyone able to execute code inside a container when the SDK is installed can read or modify memory files. As the problem stems from file permission misconfiguration, it can be mitigated by applying the patch or restricting the umask.