Claude Code Symlink Import Lets Malicious Repositories Silently Exfiltrate Local Files

This report describes a canonicalization/symlink vulnerability in Claude Code's memory import feature: a repository can include an `@import` pointing to a symlinked file that appears in-repo but resolves to a local file (e.g., `/etc/passwd`), causing the file's contents to be loaded into the model's initial context and potentially exfiltrated (including to repository-configured endpoints) before any user approval.