A vulnerability in Anthropic’s Claude Code coding agent pre-approved the hostname huggingface.co for its WebFetch tool, allowing any path on that domain, including attacker-controlled repositories, to be fetched without a permission prompt and bypassing user-configured tool restrictions. Because Hugging Face logs these requests as model downloads, an attacker who could get untrusted content into a Claude Code session could use the download count itself as a covert channel to encode and exfiltrate files, environment variables, or command output the agent had access to. The issue was patched, and no real-world exploitation has been reported.