Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code

Claude Code before version 1.0.4 had overly permissive default settings that allowed an attacker to read files and send their contents over the network without asking the user for permission. This matters because it could expose sensitive data if someone tricks the tool into processing malicious instructions.

A command allowlist bypass in Claude Code versions prior to 1.0.4 permits arbitrary file read and exfiltration via network operations without user confirmation. The attack requires injection of untrusted content into the Claude Code context window; successful exploitation results in unauthorized access to file contents and potential data exfiltration. The vulnerability stems from an overly broad safe command allowlist that failed to properly restrict file and network operations.