Security firm Adversa disclosed a vulnerability in Claude Code in which security checks on shell commands stop enforcing deny rules after a hard cap of 50 subcommands in a single pipeline, after which the tool falls back to asking the user for permission instead of blocking the command outright. Adversa demonstrated the flaw by chaining 50 no-op commands with a disallowed curl call, which Claude Code then merely asked to authorize rather than refusing; researchers warned a malicious CLAUDE.md file could use the same technique via prompt injection to exfiltrate SSH keys, AWS credentials, GitHub tokens, or other secrets. Sources disputed whether Anthropic had shipped a complete fix to the code path used in production at the time of disclosure, and no real-world exploitation was reported.