Claude Code Bypasses Developer Deny Rules Silently
Anthropic’s Claude Code contains a critical parser bug that stops enforcing developer-configured deny rules when a compound command chain exceeds 50 subcommands. An attacker can hide a malicious payload after 50 benign subcommands (for example in a poisoned CLAUDE.md in an open-source repo). Because the legacy command parser drops deny-rule evaluation and falls back to a generic prompt — which can be auto-approved in CI/automation — secrets and credentials can be exfiltrated without warning. The issue was highlighted by security researchers and covered in early April 2026; a fix exists in Anthropic’s codebase per the initial researcher disclosure.
What happened
Anthropic’s code-writing assistant Claude Code fails to apply developer-configured deny rules for compound commands that exceed a hard-coded 50-subcommand threshold. When that limit is reached, the legacy command parser stops evaluating deny rules and reverts to issuing a generic user prompt; in automated environments the prompt can be auto-approved, enabling silent execution of otherwise-blocked actions.
Technical context
Claude Code supports deny rules to block risky shell actions (curl, rm, etc.) and trusts repository-provided configuration files such as a CLAUDE.md. To limit compute and UI-blocking costs, a legacy parser enforces a maximum of 50 subcommands when performing safety checks. The parser’s behavior is to short-circuit deny-rule processing after the threshold and to fall back to a permissive prompt flow, effectively nullifying safety policy enforcement for overly long compound command sequences.
Key details from sources
Adversa’s red team disclosure and subsequent coverage show a practical attack path: publish a repository with a benign-looking CLAUDE.md that lists 50 harmless build steps, then place a malicious command at position 51. When a developer asks Claude Code to run the build, the assistant generates and executes the long command sequence; deny rules are not evaluated, and credentials (SSH keys, cloud API tokens) can be exfiltrated to an attacker server. Multiple security outlets noted the behavior and reported that a fix exists in Anthropic’s codebase. Coverage clustered in early April 2026.
Why practitioners should care
This is not a theoretical model hallucination — it’s a deterministic parser limit that converts a configured defensive policy into silence. Teams embedding Claude Code into developer tooling, CI/CD pipelines, or automated build agents face elevated risk because automation can auto-accept the fallback prompt. The attack leverages supply-chain-style repo poisoning, a realistic vector for open-source-dependent workflows.
What to do and what to watch
Immediate mitigations
disable auto-approval of execution prompts in CI, restrict execution privileges for agents (least privilege for keys/tokens), validate or ignore untrusted repository configuration files (e.g., CLAUDE.md), and add pre-execution sanitizers that split and inspect compound commands beyond 50 subcommands. Track Anthropic’s patch rollouts and upstream advisories from the researchers (Adversa) and independent coverage. Longer-term: vendors must avoid silent policy bypasses — policy enforcement must be fail-closed, not fail-open, when safety checks cannot complete.
Scoring Rationale
This vulnerability is highly relevant to AI-assisted development workflows and tools (high relevance), affects a widely used product (moderate-to-high scope), and is actionable for practitioners (moderate). Multiple independent disclosures and coverage provide solid credibility; the bypass mechanism is novel in its simplicity but not unprecedented in supply-chain exploitation.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
