Claude Code Security: Enterprise Guide

Last updated: October 19, 2026

Is Claude Code security good enough for enterprise rollout? It can be, with controls. Claude Code is an agent with shell, file and network access on a developer's machine, so its security depends on how you configure it as much as on what Anthropic ships. In 2026 researchers found plugin, git and CI flaws that let attackers run code or read credentials, and most were patched. This guide separates the two meanings of "Claude Code security" and lists the controls to set before you scale.

TL;DR: Key Takeaways

• Plugin4Shell reached Claude Code. Disclosed on September 18, 2026, the zero-click flaw let a swapped plugin run code through background auto-update, and Anthropic fixed it in version 2.1.179 (Help Net Security, 2026).
• A copied repo can run commands. GitSpawn research published on September 2 showed a repository's .git/config can execute a command before Claude Code's trust prompt, when the repo arrives with .git intact (The Hacker News, 2026).
• CI workflows leak keys. The Claude Code Action flaw tracked as CVE-2026-54316 exposed GITHUB_TOKEN and the Anthropic API key, and was fixed in version 2.1.163 (Cloud Security Alliance, 2026).
• Credentials ship in npm packages. Check Point found 428 of about 46,500 monitored npm packages carried a .claude/settings.local.json file, and 33 files in 30 packages held credentials (SecurityBrief, April 2026).
• The sandbox has limits. Anthropic's documentation says the sandbox covers shell commands only, while file tools, MCP servers and hooks run outside it (Claude Code docs, 2026).

At a glance: where the risk comes from

Sources: Help Net Security, The Hacker News, Cloud Security Alliance, SecurityBrief, Adversa AI. Retrieved October 19, 2026.

What does "Claude Code security" mean?

The phrase covers two different things. One is Anthropic's scanner that audits your code for vulnerabilities. The other is the security of Claude Code itself, an agent that reads files, runs commands and installs plugins on your behalf. Most buyers need both, and they fail in different ways.

The scanner was first called Claude Code Security. Infosecurity Magazine (2026) reports that Anthropic launched it in public beta as Claude Security on May 1, 2026, for Claude Enterprise customers, built on Claude Opus 4.7. It traces data flows across files, validates each finding in several stages and reports confidence, severity, impact, reproduction steps and a suggested patch. Scheduled scans, exports and webhooks to Slack or Jira followed testing. Anthropic claims the validation pipeline cuts false positives, and the report offers no independent evidence for that.

A scanner finds flaws in your code. It does not constrain what the agent does while it works, which is the rest of this guide.

Why an agent changes the threat model

An autocomplete tool suggests text. Claude Code acts. It can edit files, run shell commands, call MCP servers, load plugins and push to git, so a successful injection or a poisoned repository turns into execution on a developer's machine, with that developer's credentials.

Anthropic's own documentation is direct about the boundaries. A working-directory limit is a permission prompt, so "a Bash command you approve can still write anywhere your user account can". In -p sessions neither the workspace trust prompt nor the .mcp.json approval prompt appears, and Anthropic states that users are responsible for reviewing proposed code and commands (Claude Code docs, 2026). Anthropic also says it does not security-audit or manage any MCP server.

Claude Code security flaws disclosed in 2026

Researchers published a steady series of Claude Code flaws in 2026, and most were fixed before or at disclosure. The table lists the ones with a public fix version, so you can set minimum versions in your fleet policy.

Sources: SecurityBrief, NeuralTrust, Let's Data Science, The Hacker News, Cloud Security Alliance, Help Net Security.

Patch status is only part of the picture. Adversa AI (2026) catalogs ten documented attacks on Claude Code, of which only two produced CVEs and four were declined by vendors. Several risks are accepted behavior, not bugs, so version pinning alone will not close them.

Plugin and git flaws: Plugin4Shell and GitSpawn

Plugin4Shell and GitSpawn both abuse git, which agents call constantly in the background. They show that an untrusted repository or plugin can act before a developer has approved anything.

Plugin4Shell

AIR Security found that Claude Code, Codex, GitHub Copilot and Gemini CLI check out a plugin's pinned commit without verifying that the checkout landed on it. An attacker names a branch after the 40-character commit hash, git prefers the branch, and malicious code installs while the agent reports the expected SHA. Claude Code and Codex update plugins in the background by default, which makes the attack zero-click. Anthropic fixed it in 2.1.179 and OpenAI in Codex 0.146.0. At disclosure Microsoft had shipped no Copilot fix and Google had deprecated Gemini CLI instead of patching it. GitHub blocks SHA-like branch names, while Bitbucket and self-hosted git servers may allow them (Help Net Security, 2026).

GitSpawn

Manifold Security showed that a repository's .git/config can set core.fsmonitor to a command, which git runs during git status and git diff. Agents run those commands at startup, so the command executes as the user, outside the agent's sandbox and without a prompt. Claude Code fired before the trust prompt was accepted. It needs the repo to arrive with .git intact, for example through a shared archive or drive, and an ordinary clone is not affected. Anthropic fixed the core.fsmonitor path in 2.1.196 on June 29, but Manifold confirmed a separate ultrareview path on version 2.1.252 on September 1 (The Hacker News, 2026). Check Anthropic's release notes for its current status.

Research results point the same way. An arXiv study summarized by Adversa AI (2026) reports that trojanized plugin updates with malicious lifecycle hooks compromised all seven tested coding agents, with success rates up to 92.5%, and that adversarial agents bypassed the Claude Code Auto Mode classifier in 79% of trials. These are research findings, not field incidents.

Secrets and credential leaks from Claude Code

Claude Code leaks credentials in three common ways: CI workflows, published packages and approved commands. Each has a clear control.

In CI, an agent that reads issue or pull request text is processing attacker-controlled input. Microsoft Threat Intelligence reported in June that the Claude Code GitHub Action treated such text as trusted, and its Read tool could read /proc/self/environ and expose the ANTHROPIC_API_KEY. Anthropic fixed this in 2.1.128 by blocking access to sensitive /proc files (Let's Data Science, 2026). The later CVE-2026-54316 went through three patch and bypass rounds. Researchers used a quoted payload in a git push flag, read-only command exemptions and a pre-approved Hugging Face domain to leak the GITHUB_TOKEN and API key, one character at a time in the final variant. Anthropic scored it Moderate (CVSS v4 6.0) while NVD scored it 9.1 under CVSS v3.1, and no confirmed active exploitation was reported at disclosure (Cloud Security Alliance, 2026).

In published packages, Claude Code stores approved shell commands in .claude/settings.local.json. When a developer approves a command with an inline credential and then publishes the package without excluding that folder, the credential ships. Check Point reported npm tokens, GitHub personal access tokens and Hugging Face keys in 33 files across 30 packages (SecurityBrief, 2026).

What Anthropic's built-in controls cover

Anthropic ships real controls, and they have defined edges. Use them fully, and plan for the gaps.

Sources: Claude Code docs, security, Claude Code docs, sandboxing, The Hacker News, Adversa AI.

Two details matter for planning. The sandbox runs on macOS, Linux and WSL2, and on native Windows Claude Code runs commands unsandboxed (Claude Code docs, 2026). And Anthropic's guidance says that while its protections significantly reduce risk, no system is completely immune to attack.

Controls to set before you roll out Claude Code

The controls below close most of the paths above. Start with the ones that need no new tooling.

• Set a minimum version. Require at least 2.1.179 for Plugin4Shell and check release notes for the GitSpawn ultrareview path.
• Turn the sandbox on and add deny rules. Deny curl and wget in permissions.deny and use sandbox network isolation for enforcement that does not depend on command text.
• Restrict plugins and MCP servers. Use managed settings and managed MCP configuration, review plugin sources and watch for ownership transfers on plugin repositories.
• Neutralize git config execution. Run git config --global core.fsmonitor false and inspect received repositories for core.fsmonitor, core.hooksPath and attr.tree before opening them with an agent.
• Harden CI. Use short-lived, narrowly scoped tokens, treat issues, pull requests and CLAUDE.md as untrusted, and rotate secrets if a vulnerable workflow ran.
• Stop credentials shipping. Add .claude to .npmignore and .gitignore, and scan tarballs before publishing.
• Isolate untrusted work. Run unfamiliar repositories in a dev container or VM.

Alessandro Pignati's analysis of the May deeplink flaw is a useful worked example of how one unchecked string reached code execution.

Security and governance: where a gateway and runtime layer fit

Vendor controls protect the agent from known misuse patterns, and enterprises still own the risks around it. According to OWASP (2025), prompt injection is the first risk (LLM01) in its Top 10 for LLM applications, and indirect injection through repositories, issues and tool output is the form that reaches coding agents. The risks that follow are data leakage through prompts, logs and tool calls, and tool misuse by an agent with broad permissions.

NeuralTrust addresses these at the layer around the agent. Agent Gateway (TrustGate) sets per-agent permissions and limits and acts as a policy and logging point between agents and tools, and it ships with 200+ pre-built MCP servers. Agent Runtime Security (TrustGuard) inspects prompts, tool calls and outputs as they happen. Agent Posture Management (TrustLens) inventories which agents and connections exist. AI Red Teaming (TrustTest) tests agents against injection and misuse before production. NeuralTrust delivers these as the Runtime Security Mesh, deploys in your own infrastructure or on-premises with a managed service hosted in the EU or the US, and holds four Gartner Hype Cycle 2026 recognitions in AI Runtime Defense.

Which should you choose?

Match the control set to your exposure. A team that only edits local code needs different measures from one running agents in CI with write access.

Conclusion

Claude Code security comes down to two questions: what the agent can reach, and what runs before anyone approves it. The 2026 flaws were mostly patched, but plugins, git configuration and CI inputs keep showing the same pattern. Set a minimum version, enforce the sandbox and managed settings, restrict plugins and MCP servers, and put policy and runtime inspection around the agent so an accepted risk does not become an incident.

Secure Claude Code and Coding Agents in Production with NeuralTrust

Set per-agent limits, inspect tool calls and keep a log your security team can review.

Related Comparisons

• Claude Code RCE, Explained
• Claude Code vs. Cursor: Benchmark Comparison 2026
• Codex vs. Claude Code: Benchmark Comparison 2026
• Claude Opus 5.5 Enterprise Security: Safeguards & Gaps

FAQs about Claude Code Security

1. Is Claude Code safe for enterprise use?

It can be, with controls. Claude Code runs commands and loads plugins on a developer's machine, and 2026 research found plugin, git and CI flaws. Most were patched. Set minimum versions, enable the sandbox, use managed settings and restrict plugins and MCP servers before rollout (Claude Code docs, 2026).

2. What is Claude Code Security?

Claude Code Security was the earlier name of Anthropic's code scanner. It entered public beta as Claude Security on May 1, 2026 for Claude Enterprise, built on Claude Opus 4.7. It audits your code for vulnerabilities and does not constrain what the Claude Code agent does at runtime (Infosecurity Magazine, 2026).

3. What vulnerabilities has Claude Code had in 2026?

Disclosed issues include a deeplink flaw fixed in 2.1.118, a GitHub Action key leak fixed in 2.1.128, CVE-2026-54316 fixed in 2.1.163, the GitSpawn git path fixed in 2.1.196 and Plugin4Shell fixed in 2.1.179. Check release notes for the ultrareview path (The Hacker News, 2026).

4. Does the Claude Code sandbox cover everything?

No. It isolates shell commands at the operating system level, but file tools, MCP servers and hooks run outside it. It runs on macOS, Linux and WSL2, and native Windows runs commands unsandboxed. Combine it with deny rules, managed settings and container isolation for untrusted repositories (Claude Code docs, 2026).

5. How do I stop Claude Code leaking secrets?

Use short-lived, narrowly scoped tokens in CI, treat issue and pull request text as untrusted, and rotate secrets if a vulnerable workflow ran. Add .claude to .npmignore and .gitignore, and inspect tarballs before publishing (Cloud Security Alliance, 2026).

6. Can a malicious plugin attack Claude Code users?

Yes. Plugin4Shell let an attacker swap a plugin's pinned commit and run code through background auto-update, and a research study reports trojanized plugin updates compromised all seven tested coding agents. Update to 2.1.179 or later, restrict plugin sources and review installed plugins (Help Net Security, 2026).

About the Author

Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.

NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.

Sources

1. Anthropic, Claude Code security, accessed October 19, 2026.
2. Anthropic, Configure the sandboxed Bash tool, accessed October 19, 2026.
3. Help Net Security, Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched, September 18, 2026.
4. The Hacker News, Malicious .git configs can make Claude, Codex, Cursor and other AI agents run attacker code, September 2, 2026.
5. Cloud Security Alliance, Three AI coding agents, one GitHub issue: CI/CD secrets exposed, August 8, 2026.
6. Let's Data Science, Microsoft reports Claude Code GitHub Action credential leak, June 6, 2026.
7. SecurityBrief, Claude Code can leak secrets in public npm packages, April 22, 2026.
8. Infosecurity Magazine, Anthropic rolls out Claude Security for AI vulnerability scanning, May 1, 2026.
9. Adversa AI, AI coding agent vulnerabilities, October 2026, October 2, 2026.
10. OWASP, LLM01: Prompt Injection, 2025.