Claude Code security for enterprises

Last updated October 19, 2026

Claude Code runs with the permissions of the developer who started it. It reads files, runs commands, connects to MCP servers and sends context to a model provider. This guide lists the risks reported so far and the controls that reduce them.

The main Claude Code security risks

1. Secrets in prompts and context

   The agent sends whatever you paste, and whatever it reads, to a model provider. Keys, tokens and customer data pasted into a prompt leave the machine. Prompt inspection with redaction keeps them out of the conversation.

2. Environment files and local credentials

   Security researchers (Knostic) reported that Claude Code reads .env-style files by default, which many developers do not expect. Deny rules for .env, ~/.ssh and secrets directories close this gap.

3. Saved approvals that keep credentials

   Lakera reported that choosing "allow always" for a shell command can store credentials from that command in .claude/settings.local.json, and Check Point found that file can be published to public npm packages if it is not excluded. Review and ignore that file.

4. Prompt injection through files, issues and tools

   Instructions hidden in a repository, web page or tool response can steer an agent. OWASP lists agent goal hijack first in its Top 10 for Agentic Applications (published December 2025). Limit what the agent can run and reach, since injection cannot be fully eliminated.

5. Malicious repositories and hooks

   Check Point disclosed vulnerabilities, including CVE-2025-59536 and CVE-2026-21852, where a malicious project configuration could run code or expose API keys. They have been patched, so keep Claude Code updated and treat unfamiliar repositories as untrusted.

6. Unvetted MCP servers and skills

   Every MCP server or skill is new code and new access. Keep an inventory, allow only approved servers, and watch for changes to their tools or permissions.

Controls that reduce the risk

• Use company accounts and managed settings instead of personal logins.
• Deny access to .env files, ~/.ssh, cloud credential files and secrets directories.
• Keep sandboxing on and avoid permission-bypass flags such as --dangerously-skip-permissions.
• Allow only approved MCP servers, skills and hooks.
• Inspect and redact prompts before they leave the company.
• Log what agents do so incidents can be reconstructed.
• Shorten how long local session transcripts are kept.

Where Rechazo fits

Rechazo inspects each prompt before it leaves the company, watches what coding agents do on the machine, and keeps credentials out of the conversation. It works alongside Claude Code's own settings rather than replacing them.

Join the Rechazo waitlistAbout RechazoTalk to the team

Findings above are reported by third-party security researchers and vendors; check each primary source before relying on it. Claude and Claude Code are trademarks of Anthropic, PBC. Rechazo is independent and not affiliated with Anthropic.