Critical Claude Code Flaw Silently Bypasses User-Configured Security Rules

A critical flaw in Anthropic’s Claude Code allows developers’ deny rules (blocking actions like curl or rm) to be skipped when a generated compound command contains more than 50 subcommands; attackers can exploit this by hiding malicious commands at position 51 in build sequences (e.g., via poisoned repository CLAUDE.md) to exfiltrate SSH keys, cloud credentials, or API tokens. Anthropic has patched the issue in Claude Code v2.1.90, but the report warns unpatched users to restrict shell access, monitor outbound connections, and audit external repository configuration files.