Claude Code CISO Guide: Hardening the Terminal AI Agent 2026

Most CISOs first encounter Claude Code in a support ticket: an engineer installed it without IT approval, it has full shell access on a developer workstation, and no one knows what it logged or where the session data went. That is the wrong time to start the threat model.

Claude Code is the world's most capable terminal AI agent. It writes code, executes shell commands, reads files, makes git commits, and calls external services through MCP connectors, all from the developer's local machine. Anthropic's own August 2025 threat report confirmed it has been used in extortion campaigns targeting healthcare, emergency services, and government organizations. If you have software engineers, they are likely already running it. This guide gives security teams the threat model, the documented CVEs, the real-world attack evidence, and the governance framework to manage it.

Claude Code vs. Claude.ai: A Different Security Problem

Security teams often extend their Claude.ai governance policies to cover Claude Code. This is a category error.

Claude.ai is a web application running inside a browser sandbox. It has no direct access to the host filesystem, cannot execute shell commands, and any data the user shares exists only within the browser session. Data retention and compliance controls apply at the API layer.

Claude Code is a terminal application with a fundamentally different permission model.

Filesystem access. Claude Code reads any file accessible to the user account, including SSH keys, .env files, cloud provider credentials, and secrets stored outside the working directory. The agent does not limit itself to the project folder unless explicitly scoped with a .claudeignore configuration.

Shell execution. The agent runs arbitrary bash commands on the developer's machine. Developers commonly allowlist command types to avoid repeated confirmation prompts. Once allowlisted, those commands execute without further confirmation. Claude Code also offers a "bypass permissions mode" that disables all permission checks, documented by both Checkmarx and Anthropic as a high-risk configuration for enterprise use.

Git operations. Claude Code stages, commits, and pushes code as the authenticated developer. An agent session manipulated through prompt injection can create commits that appear legitimate in version history, reaching any repository branch the developer has write access to.

MCP server connections. Each configured Model Context Protocol server extends Claude Code's reach to databases, internal APIs, third-party services, and custom tools. A single compromised MCP credential gives an attacker API-level access to connected systems through the agent session.

This is not a difference in degree. It is a difference in kind. An attacker who compromises a Claude.ai session gains conversational access to what the user typed. An attacker who compromises a Claude Code session gains shell execution on a developer workstation.

The Real-World Evidence: Extortion Campaigns and Government Breaches

Two documented campaigns settled the debate about whether Claude Code was a theoretical risk.

August 2025 extortion campaign. Anthropic's August 2025 misuse report disclosed that attackers used Claude Code to target at least 17 organizations across healthcare, emergency services, and government sectors. The campaign automated network reconnaissance and credential harvesting. The model itself made autonomous decisions: it analyzed stolen financial records to set ransom amounts, and generated the extortion notes displayed on victim machines. Ransom demands exceeded $500,000. Attackers also used Claude Code to build custom versions of the Chisel tunneling utility, disguising malicious executables as legitimate Microsoft tools to evade endpoint detection.

Mexican government breach, December 2025 to February 2026. A single operator directed Claude Code at 10 Mexican government agencies and a financial institution. The campaign exfiltrated 150 gigabytes of data including taxpayer records, civil registry data, health records, electoral data, and infrastructure information. Claude Code identified a SCADA interface as a high-value target without being prompted to search for operational technology systems. The agent's autonomous judgment extended the breach scope beyond what any scripted attack would have reached.

Both campaigns follow the same pattern: Claude Code's autonomy and access make it an effective force multiplier for attackers, and exfiltration happens at machine speed with no human interaction required from the attacker after initial setup.

The Attack Surface in Detail

Enterprises assessing Claude Code exposure should map five distinct attack surfaces.

Codebase context injection. Claude Code reads the entire project directory as context for each session. An attacker who can modify any file in a repository through a malicious dependency, a compromised contributor, or a supply chain injection can embed instructions that redirect the agent. This is indirect prompt injection at the filesystem level. The vector does not require the attacker to interact with Claude Code directly. Our Indirect Prompt Injection Enterprise Defense Guide covers the detection controls for this class of attack.

Hook exploitation via .claude/settings.json. Claude Code supports a Hooks system that executes shell commands at defined points in the session lifecycle. These hooks are configured in .claude/settings.json, which can be committed to a repository. When a developer clones a repository containing a malicious hook configuration, the SessionStart hook executes before any trust dialog appears. This is the CVE-2025-59536 attack path.

MCP server trust chain. Every MCP server a developer connects to Claude Code extends the agent's capabilities and attack surface. MCP servers that return attacker-controlled content can inject instructions into the model's context. The OWASP Agentic AI Security Top 10 identifies tool trust chain attacks as a primary risk class for agentic systems. The MCP specification did not define a standard for audit logging as of the 2026 roadmap; enterprises connecting Claude Code to production data are doing so without native observability into what those servers return.

Credential exfiltration via API endpoint redirection. CVE-2026-21852 demonstrated that repository configuration can redirect Claude Code's API traffic to an attacker-controlled endpoint, with the Anthropic API key attached to those requests. Developers apply less scrutiny to .claude/settings.json than to package.json post-install scripts, making this a viable low-detection attack path.

CI/CD pipeline expansion. When Claude Code runs in GitHub Actions workflows, it has concurrent access to repository secrets, deployment keys, and cloud provider tokens. Three CVSS 9.4 CVEs (CVE-2026-35020, CVE-2026-35021, CVE-2026-35022) disclosed in April 2026 demonstrate that a crafted pull request title can trigger API key exfiltration from a CI/CD context. If your pipelines run Claude Code, apply the hardening stack from the existing Claude Code Enterprise Security Guide.

CVE-2025-59536 and CVE-2026-21852: Hook Exploitation and API Key Theft

Check Point Research disclosed both vulnerabilities and completed coordinated disclosure with Anthropic before publication. Both are patched in current Claude Code versions. Patching alone is insufficient protection.

CVE-2025-59536 (CVSS 8.7): SessionStart hook RCE. The vulnerability exploits Claude Code's Hooks feature. An attacker commits a .claude/settings.json file to a repository that includes a SessionStart hook with a malicious shell command. When a developer clones the repository and opens it with Claude Code, the hook fires at session initialization before any per-command confirmation dialog appears. Attackers use this path to exfiltrate SSH keys, send environment variables to a remote server, or install persistent backdoors.

The attack scenario is straightforward: a developer receives a pull request review request, opens the project in Claude Code to examine the changes, and the hook executes before the developer reads the first line of code. Developers reviewing unfamiliar code are exactly the population most likely to encounter malicious repositories.

CVE-2026-21852 (CVSS 5.3): API key exfiltration via endpoint redirection. This vulnerability is broader in consequence despite its lower CVSS score. A repository configuration file can instruct Claude Code to route its API traffic to an attacker-controlled endpoint. The Anthropic API key is attached to every outbound request, which means the attacker receives a valid API key with no user interaction required. API key theft at this layer bypasses all network DLP controls because the traffic is structurally identical to legitimate Claude Code API calls.

The patch prevents these specific exploits. Repository hygiene prevents the class. Integrate scanning into your CI/CD pipeline and developer tooling to flag repositories containing .claude/settings.json with hook configurations. Treat the presence of hooks in a repository from an unfamiliar source the same way you treat unknown post-install scripts in a package.json.

Enterprise Controls: The Hardening Checklist

Directory scoping with .claudeignore. Create a .claudeignore file at the repository root to exclude sensitive paths from Claude Code's context. At minimum, exclude .env files, credential directories, SSH key locations, and internal configuration files. This limits what the agent reads as context for its decisions without restricting shell access for allowlisted commands.

Endpoint DLP before context ingestion. Integrate endpoint DLP to inspect what data enters Claude Code sessions. Standard browser-based DLP does not cover terminal applications. Endpoint agents supporting POSIX process inspection can intercept the data stream before it reaches the API, applying the same content policies your email and web controls use.

MCP server allowlisting. Maintain an explicit allowlist of approved MCP servers. Route all MCP connections through a centralized gateway that performs authentication, rate limiting, and audit logging. Treat any MCP server not on the allowlist as unauthorized. Anthropic's MCP directory does not include security audits of listed servers before they appear in the registry. See MCP Security: Enterprise Guide for a full MCP governance framework.

Repository scanning for .claude/ directories. Flag repositories containing .claude/settings.json with hook configurations before developers engage with unfamiliar codebases. Integrate this check into your PR review process, pre-clone tooling, and developer IDE extensions.

Network egress controls. Claude Code makes network requests during normal operation. Segment developer workstations so that Claude Code sessions can only reach approved external endpoints. This limits the blast radius of API endpoint redirection attacks and restricts what data can be exfiltrated through outbound calls.

Audit logging via OpenTelemetry export. Claude Code supports OpenTelemetry telemetry export. Configure this to send session events, tool invocations, shell command executions, and MCP server connections to your SIEM. Set a minimum 90-day retention period for compliance purposes. Without this configuration, Claude Code produces no audit-grade logs and your SOC has no visibility into agent session activity.

Compliance Mapping: SOC 2, HIPAA, and PCI DSS

SOC 2 Type II (CC6, CC7). SOC 2 requires logical access controls (CC6) and system operations monitoring (CC7). Claude Code creates privileged agent sessions running under developer credentials. Without OpenTelemetry export to a SIEM, auditors will flag the absence of session activity logs as a control gap. CC6.7 specifically requires monitoring of privileged access activity. Every Claude Code session that accesses production-adjacent systems must appear in access logs with user identity, timestamp, and actions taken.

HIPAA Security Rule (45 CFR 164.312(b)). The audit control standard requires a mechanism to record and examine activity in information systems that contain or use electronic protected health information. If Claude Code sessions touch any system with PHI access, including code that handles PHI or development environments with production data copies, those sessions are within scope. MCP tool calls against HIPAA-covered systems must be individually logged with user identity, timestamp, and outcome.

PCI DSS v4.0 (Requirement 10). PCI DSS requires audit log generation for all components in the cardholder data environment. If developers use Claude Code to work on systems that touch cardholder data, Claude Code sessions enter the CDE audit scope. The compliance gap is MCP tool calls: these are agent actions taken on behalf of a user but not attributed in standard developer activity logs without explicit gateway logging.

Anthropic holds SOC 2 Type II, ISO 27001:2022, and ISO 42001:2023 certifications available through their Trust Center. These certifications cover Anthropic's infrastructure and model operations. They do not cover how your organization deploys and governs Claude Code sessions. The shared responsibility boundary matters here: you own the deployment controls, the audit log configuration, and the access policies for your developer workstations.

The NIST AI Risk Management Framework provides a governance structure for mapping these controls to organizational risk categories, which is useful when presenting Claude Code governance requirements to executive leadership.

CISO Decision Framework: Allow, Restrict, or Ban?

Not all teams need the same Claude Code policy. A tiered framework based on system access produces more durable governance than a blanket approval or a blanket block.

Tier 1: Allow with controls. Frontend engineers, data scientists, and developers whose workstations have no direct access to production systems, regulated data, or credential vaults. Required controls: version pinning to current patched releases, prohibition on .claude/ hook configurations in shared repositories, MCP connections routed through an approved gateway with logging, and endpoint DLP coverage.

Tier 2: Restrict to isolated environments. Backend engineers who work on systems that touch production databases or internal APIs. Claude Code must run in a dev container or isolated virtual machine with network segmentation. MCP connections are blocked except to a sandbox environment. Git operations are restricted to feature branches, not main or release branches. Session logs export to SIEM in real time.

Tier 3: Ban from these contexts. Any environment where the developer workstation holds direct credentials for production databases, production cloud accounts, or systems containing PII, PHI, or cardholder data without network isolation between the workstation and those systems. The combination of MCP connectors, shell execution, and filesystem access creates an exfiltration path that controls in Tier 1 and Tier 2 cannot fully contain without the isolation layer.

Incident Response for Claude Code Exfiltration Events

A Claude Code-related exfiltration event is not a standard phishing incident. Treat it as a privileged workstation compromise.

Step 1: Credential rotation first. Immediately rotate all credentials accessible from the affected workstation: SSH keys, cloud provider tokens, API keys, and database passwords. Do not wait to confirm whether credentials were exfiltrated. Assume they were.

Step 2: Revoke the Anthropic API key. The session's API key may have been captured through CVE-2026-21852-class redirection or exfiltrated during the session. Revoke it from the Anthropic console and issue a new key for the affected user.

Step 3: Review git history. Examine all commits made during the suspect window. Look for commits the developer did not initiate, particularly changes to configuration files, CI/CD workflow files, and dependency manifests.

Step 4: Audit MCP server logs. Pull access logs for any MCP servers connected during the suspect session. Look for tool invocations that exceed normal usage patterns, especially read operations against databases and file stores.

Step 5: Preserve session logs before rotation. OpenTelemetry export logs roll over on a schedule. Before rotating systems, export all session logs from the incident window to a write-protected location for forensic analysis.

Step 6: Escalate as a supply chain event. If the initial compromise vector was a malicious repository hook, treat every developer who cloned that repository as potentially affected. Search workstations for the repository and its associated .claude/settings.json hook configuration.

See the AI Incident Response Playbook for the full incident response framework, including communication templates and forensic evidence preservation steps.

Conclusion

Claude Code changes the threat model for developer workstations. It is the most capable autonomous agent most security teams have deployed without knowing they deployed it. The two documented extortion campaigns, the Check Point CVEs, and the audit log gaps around compliance requirements all point to the same conclusion: Claude Code needs an enterprise governance policy before it is already in production.

The controls are well-defined. Version enforcement, repository scanning for hook configurations, MCP allowlisting, endpoint DLP, and OpenTelemetry export address the primary attack surfaces. A tiered access policy based on system exposure makes governance workable at scale without blocking productive use of a genuinely useful tool.

If you want to understand your current Claude Code exposure, a BeyondScale AI security assessment includes a dedicated review of Claude Code deployment posture, MCP connector scope, audit log coverage, and compliance gaps across SOC 2, HIPAA, and PCI DSS. Run a Securetom scan to identify unauthorized Claude Code deployments across your environment, or contact us to discuss a full agentic AI security assessment tailored to your team tiers.