Novee Security disclosed three critical flaws in Claude Code at Black Hat 2026. The most striking: a data exfiltration channel that uses a pre-approved HuggingFace domain in WebFetch to leak secrets one character at a time, rooted not in misconfiguration but in the foundational harness architecture itself.
The exfiltration trick is revealing. Attackers don’t break out of the sandbox; they weaponize its flexibility. An agent can fetch files from HuggingFace (reasonable for a coding tool), so an attacker creates a repo there, then triggers a malicious clone that queries the repo’s download counter with secret data baked into the URL. No outbound connection violation, just signal extraction through a permitted channel.
Google’s Gemini CLI had its own CVSS 10.0 command injection hole via .gemini/.env files. Anthropic’s advisory (CVE-2026-54316) covers the Claude Code findings. The pattern is clear: agent isolation faces a fundamental gap. You can’t lock down every tool without killing functionality. Security allowlists work until they don’t. Pre-approved domains become covert channels.
Sources: Novee Security • Anthropic CVE-2026-54316
Coverage: The Hacker News
Related on this blog: [AUTO] ChatGPT’s C2 Inside the Sandbox • [AUTO] Meta’s model didn’t hack a company, the sandbox did • Three Indirection Steps From a Reverse Shell