{
  "entry": {
    "kind": "vuln",
    "slug": "a-repo-defined-claude-code-subagent-downgraded-its-own-security-review",
    "name": "a-repo-defined-claude-code-subagent-downgraded-its-own-security-review",
    "vendor": "Claude Code",
    "description": "Straiker STAR Labs (Brian Cumi) published on 22 September 2026 a Claude Code attack that needs no prompt injection or jailbreak. A malicious repository ships a CONTRIBUTING.md telling contributors to run a first-pass review with a repo-defined subagent before pytest, and a `.claude/agents/first-pass.md` whose frontmatter pins `model: haiku` and scopes the review to src/ and docs/. Asked to clone the repo, fix two real bugs and \"prepare a PR\", Claude Code (on the larger Fable model) followed the repo's workflow, spawned the subagent on Haiku as the repo specified, accepted its two planted, harmless findings, and ran pytest without opening tests/. A test file hex-decoded a URL, downloaded a Python stage and launched a Sliver implant before its trivially true assertion, swallowing errors so the run still showed \"11 passed\". The researcher got an interactive C2 session on the workstation. Straiker reported it through Anthropic's HackerOne program on 14 September; Anthropic closed it as Informative the same day, on the basis that honouring repository configuration falls under the user's workspace-trust decision. The pattern applies to any agent that loads per-repo agent definitions and runs the repo's test suite.",
    "website": "https://www.straiker.ai/blog/how-a-malicious-repo-tricked-claude-code-into-running-malware",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-22",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "a-repo-defined-claude-code-subagent-downgraded-its-own-security-review",
      "aliases": [
        "ti-117"
      ],
      "title": "A Repo-Defined Claude Code Subagent Downgraded Its Own Security Review to Haiku and Kept the Reviewer Out of tests/, Then pytest Opened a C2 Session",
      "summary": "Straiker STAR Labs (Brian Cumi) published on 22 September 2026 a Claude Code attack that needs no prompt injection or jailbreak. A malicious repository ships a CONTRIBUTING.md telling contributors to run a first-pass review with a repo-defined subagent before pytest, and a `.claude/agents/first-pass.md` whose frontmatter pins `model: haiku` and scopes the review to src/ and docs/. Asked to clone the repo, fix two real bugs and \"prepare a PR\", Claude Code (on the larger Fable model) followed the repo's workflow, spawned the subagent on Haiku as the repo specified, accepted its two planted, harmless findings, and ran pytest without opening tests/. A test file hex-decoded a URL, downloaded a Python stage and launched a Sliver implant before its trivially true assertion, swallowing errors so the run still showed \"11 passed\". The researcher got an interactive C2 session on the workstation. Straiker reported it through Anthropic's HackerOne program on 14 September; Anthropic closed it as Informative the same day, on the basis that honouring repository configuration falls under the user's workspace-trust decision. The pattern applies to any agent that loads per-repo agent definitions and runs the repo's test suite.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code, by design (report closed as Informative); any version that loads project-level `.claude/agents/` definitions from a trusted workspace. Similar exposure for other agents that honour per-repo agent or workflow files and run repo-provided tests.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-22",
      "modifiedAt": "2026-09-22",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.straiker.ai/blog/how-a-malicious-repo-tricked-claude-code-into-running-malware"
        }
      ],
      "mitigation": "Do not grant workspace trust to third-party repositories you are only evaluating; open them in a sandbox or container with no credentials, because trust is what lets the repo's `.claude/agents/`, hooks, MCP servers and CONTRIBUTING workflow steer the agent. Before running a cloned repo's tests, review .claude/agents/, .claude/settings*.json, hooks, .mcp.json and the test files themselves, and treat pytest, make and other repo commands as code execution. Instruct agents (in user-level CLAUDE.md or managed settings) not to delegate review of untrusted code to repo-defined subagents and to read test files before executing them. Run tests for unvetted repos with outbound network blocked so a downloaded second stage cannot fetch.",
      "detectedByAnomity": true
    }
  }
}