Researchers from Check Point have disclosed multiple vulnerabilities in Anthropic’s Claude Code AI coding assistant that could allow remote code execution (RCE) and theft of sensitive API credentials when developers open untrusted repositories. The issues stem from configuration abuse involving Hooks, Model Context Protocol (MCP) servers, and environment variables, enabling attackers to execute arbitrary shell commands and exfiltrate Anthropic API keys without meaningful user interaction. The flaws include a consent-bypass code injection vulnerability tied to project hooks (fixed in v1.0.87), CVE-2025-59536 allowing automatic command execution during tool initialization in untrusted directories (fixed in v1.0.111), and CVE-2026-21852, which exposes API keys through manipulated project-load behavior (fixed in v2.0.65). Exploitation could occur simply by opening a malicious repository that redirects API traffic to attacker-controlled infrastructure, enabling credential capture, unauthorized data access, cloud data manipulation, and unexpected API usage costs. Researchers emphasized that AI development environments expand the traditional supply-chain threat model, as configuration files and automation layers now directly influence execution behavior, making the act of opening untrusted projects itself a significant security risk.