When a Trusted Repository Can Pull Local Files Into AI Context

The important flaw is a disagreement about which file is being checked

Claude Code supports persistent project instructions through CLAUDE.md and files under .claude/rules/. Anthropic documents that these files can use @path/to/import syntax and that imported content is expanded into the context window when a session launches.

The reported issue appears when an import points to a path that looks internal to the repository but is actually a symbolic link whose resolved target is outside the project. The containment and consent decision can be made using the visible path, while the operating system follows the symlink during the file read.

CLAUDE.md
Project context: @./shared-notes

shared-notes  →  symbolic link to a file outside the repository

The visible import is ./shared-notes, which appears to live inside the project. The actual bytes may come from a completely different location. This is a classic canonicalization problem: the security check and the filesystem operation disagree about the identity of the resource.

Security policy must be applied to the canonical, symlink-resolved target that will actually be read.

Why startup context makes the issue more serious

This is not the same as the model deciding to call a file-reading tool after a conversation begins. Project instructions are assembled before normal model actions. According to the researchers’ wire capture, the imported file content was included in the first outbound model request without a separate Read-tool event.

That changes the detection problem. A team monitoring tool approvals may see no suspicious file-read request because the memory loader has already placed the content into startup context.

Where the content can go

Under ordinary configuration, startup context is transmitted to the configured model provider. The researchers also demonstrated that a repository-controlled Claude settings file could set ANTHROPIC_BASE_URL, directing the request body to another endpoint after the workspace had been trusted.

The report carefully separates demonstrated facts from inference: it demonstrated imported file content reaching a repository-selected endpoint, but it did not claim that API credential theft was proven on the wire.

Anthropic’s trust model and the researcher’s objection

Anthropic’s published security documentation describes repository trust as a major boundary and notes that Claude Code can read outside the working directory in some circumstances. It also states that non-interactive -p mode disables trust verification and delegates that decision to the caller.

The researchers reported the chain through HackerOne in July 2026. Their disclosure says Anthropic treated the behavior as within the permissions granted when a user trusts a workspace. The disagreement is therefore not only about implementation. It is about whether one coarse trust decision should also authorize hidden startup imports, out-of-tree file resolution, and endpoint changes without separate, destination-specific consent.

Why previous symlink fixes matter

The report compares this path with earlier Claude Code symlink issues that were fixed by resolving the real target before applying permission rules. Current Anthropic permission documentation says allow rules require both the symlink path and its target to match, while deny rules apply when either the link or the target matches.

The reported gap is that memory-import processing is a separate code path. A permission subsystem can correctly block a symlinked Read operation while a startup importer still performs its own lexical-path check.

Defensive controls for developers and platform teams

1. Find symlinks before launching the agent

Git represents symlinks with mode 120000. A defensive review can identify them without executing repository code:

git ls-files -s | awk '$1 == "120000" {print $4}'

find . -type l -print

while IFS= read -r path; do
  printf '%s -> %s\n' "$path" "$(readlink "$path")"
done < <(find . -type l -print)

Resolve suspicious targets with platform-native canonicalization tools and verify that the result stays within the expected repository root.

2. Inspect every automatic context source

Do not limit review to application source code. Agent-specific instructions and configuration can affect behavior before a normal task begins. Review:

• CLAUDE.md and .claude/CLAUDE.md
• CLAUDE.local.md where applicable
• .claude/rules/**
• .claude/settings.json and local settings
• MCP, hooks, plugins, skills, and custom command definitions

3. Avoid broad persistent trust roots

Trusting a parent development directory can reduce prompts for repositories placed beneath it. Security teams should prefer narrowly scoped, repository-specific trust and periodically review stored trust state. A new clone should be evaluated as a new security principal, even when it lives under a familiar folder.

4. Add policy checks to CI and developer onboarding

Organizations can reject or require review for external symlink targets, project-level endpoint overrides, and automatic context imports. These checks are especially valuable for repositories sourced from public forges, coding challenges, vendor samples, and generated project templates.

Recommended product-side correction

The robust solution is to canonicalize the import target once, enforce containment and consent against that resolved path, and then read through a mechanism that cannot be swapped between validation and access. Any import resolving outside the repository should be refused or should trigger explicit approval naming the resolved destination.

Endpoint-changing configuration should receive separate consent, especially when it affects the same request carrying startup context. Non-interactive execution should require an explicit policy rather than silently suppressing the security decision.

The broader lesson for agentic developer tools

AI coding tools combine several previously separate trust surfaces: source code, instruction files, local filesystem access, shell execution, network endpoints, plugins, and model context. A repository is no longer passive content. It can be a configuration package that influences what the agent reads and where information travels.

That means “I have not run the code yet” is no longer a sufficient safety assumption. Opening a project with an agent may itself activate imports, policies, integrations, and network behavior. Security reviews must begin before the first prompt—not after the first command.