Researchers found security flaws in Claude Code that could let attackers run malicious code and steal API keys through infected repositories.

Security researchers have discovered serious vulnerabilities in Claude Code, an AI-powered coding assistant developed by Anthropic, that could have allowed attackers to remotely execute code on developers’ machines and potentially steal sensitive API keys.

The flaws were identified by researchers at Check Point Software, who reported the issues to Anthropic. The company has since fixed the vulnerabilities and assigned official CVE identifiers to two of them. However, experts warn that the incident highlights growing supply chain risks as more businesses integrate AI coding tools into their development workflows.