# CVE Audit: How Hazmat Defends Against Known Claude Code Vulnerabilities

This document analyzes every known Claude Code CVE (as of March 2026) and maps
each attack against hazmat's containment layers. The goal is to be specific:
which layer stops which step, and what residual risk remains.

For the full incident history and ecosystem CVE catalog, see
[security-evidence.md](research/security-evidence.md).

---

## Containment Layers Referenced

| Layer | Enforcement | Code |
|-------|-------------|------|
| **User isolation** | Dedicated `agent` macOS user. Primary user's home is structurally inaccessible. | `hazmat/init.go` — `setupAgentUser()` |
| **Seatbelt** | Per-session kernel sandbox policy. Default deny, explicit allows for project and toolchain paths. | `hazmat/session.go` — `generateSBPL()` |
| **Credential deny** | Explicit `(deny file-read* file-write*)` for `.ssh`, `.aws`, `.gnupg`, Keychain, `.config/gcloud`, etc. Last-match-wins in SBPL. | `hazmat/session.go:504-522` |
| **pf firewall** | Port-based rules block SMTP, IRC, FTP, Tor, SOCKS, VPN, SMB, RDP, ICMP for `user agent`. | `hazmat/init.go` — `pfAnchorContent` |
| **DNS blocklist** | Known tunnel/paste services resolve to localhost via `/etc/hosts`. | `hazmat/init.go` — `setupDNSBlocklist()` |
| **env -i boundary** | Agent sessions start with `env -i` — no host environment variables leak across the privilege transition. | `hazmat/session.go:478` |

---

## Remote Worker Scope

This audit covers local Hazmat sessions only. Remote/orchestrated workers are
not implemented and are not a supported containment layer today.

Remote execution would add a new attack surface: control-plane authentication,
worker identity, envelope integrity and replay defense, path mapping, credential
handles, telemetry, and cleanup. Before any remote runner is implemented or
claimed as a CVE mitigation, this audit and the threat model must be updated
and the remote admission model must be proved. Until then, remote envelope
artifacts are planning records, not executable authority. See
[remote launch envelope schema](plans/2026-06-02-remote-launch-envelope-schema.md).

---

## Complete Claude Code CVE Catalog

| CVE | CVSS | Class | Fixed in | Hazmat verdict |
|-----|------|-------|----------|----------------|
| [CVE-2025-52882](#cve-2025-52882) | 8.8 | WebSocket origin bypass (IDE) | 1.0.24 | Not applicable (CLI only) |
| [CVE-2025-54795](#command-parsing-bypass-family) | 9.8 | Command parsing bypass | 1.0.20 | Strong |
| [CVE-2025-55284](#cve-2025-55284) | 7.1 | Permissive allowlist | 1.0.4 | Strong |
| [CVE-2025-58764](#command-parsing-bypass-family) | 9.8 | Command parsing bypass | 1.0.105 | Strong |
| [CVE-2025-59041](#cve-2025-59041) | 9.8 | Pre-trust RCE via git config | 1.0.105 | Strong |
| [CVE-2025-59536](#cve-2025-59536) | 8.7 | Pre-trust RCE via project files | 1.0.111 | Strong |
| [CVE-2025-59829](#symlink-bypass-family) | 6.5 | Symlink deny bypass | 1.0.120 | Strong |
| [CVE-2025-64755](#command-parsing-bypass-family) | 8.8 | Sed validation bypass → arbitrary writes | 2.0.31 | Strong |
| [CVE-2025-66032](#command-parsing-bypass-family) | 9.8 | $IFS / short-flag parsing bypass | 1.0.93 | Strong |
| [CVE-2026-21852](#cve-2026-21852) | 5.3 | API key exfiltration via config redirect | 2.0.65 | Partial |
| [CVE-2026-24052](#cve-2026-24052) | 6.5 | Domain validation bypass | 1.0.111 | Partial |
| [CVE-2026-24887](#command-parsing-bypass-family) | 8.8 | Find command parsing bypass | 2.0.72 | Strong |
| [CVE-2026-25723](#command-parsing-bypass-family) | 8.8 | Piped sed command injection | 2.0.55 | Strong |
| [CVE-2026-25724](#symlink-bypass-family) | 6.3 | Symlink deny bypass (second instance) | 2.1.7 | Strong |
| [CVE-2026-25725](#cve-2026-25725) | 8.8 | Sandbox escape via settings.json | 2.1.2 | Effective |
| [CVE-2026-33068](#cve-2026-33068) | 8.8 | Trust dialog bypass via repo settings | 2.1.53 | Effective |

---

## CVE-2025-59536 — RCE via Malicious Project Files

| | |
|---|---|
| **CVSS** | 8.7 |
| **Vector** | Malicious `CLAUDE.md` or project config triggers shell execution during initialization — before any trust prompt |
| **Impact (unmitigated)** | Arbitrary command execution as the user running Claude Code |
| **Reference** | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-59536), [Check Point Research](https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/) |

### Attack chain vs. hazmat

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. User opens malicious repo | Agent initializes, reads crafted project files | Same — hazmat does not filter project content |
| 2. Hidden instructions trigger shell execution | Commands run as primary user (`dr`) | Commands run as `agent` user inside seatbelt sandbox |
| 3. Payload reads `~/.ssh/id_rsa`, `~/.aws/credentials` | **Succeeds** — same user, same filesystem | **Blocked** — agent user cannot traverse `/Users/dr/`. Seatbelt credential deny blocks `/Users/agent/.ssh` etc. at kernel level |
| 4. Payload exfiltrates via SMTP/IRC/DNS tunnel | **Succeeds** — no network restrictions | **Blocked** — pf rules deny SMTP (25/465/587), IRC (6660-6697), Tor (9050/9150). DNS blocklist blocks ngrok, pastebin, etc. |
| 5. Payload modifies `~/.zshrc`, `~/.gitconfig` for persistence | **Succeeds** — primary user's config is writable | **Blocked** — agent cannot write to `/Users/dr/`. Agent's own rc files are scoped to `/Users/agent/` |
| 6. Payload exfiltrates project source via HTTPS | **Succeeds** | **Succeeds** — HTTPS (443) is intentionally allowed for API access |

**Residual risk:** The RCE still executes within the sandbox. It can read/modify
the project directory and exfiltrate workspace files over HTTPS. If Claude is
using API-key auth, that key is still readable inside the live Claude session,
but it is no longer stored persistently in `/Users/agent/.zshrc`.

**Verdict: Strong mitigation.** The attack degrades from "full system
compromise" to "workspace-scoped compromise," recoverable via `hazmat restore`.

---

## CVE-2025-59041 — RCE via Git Config Email Injection

| | |
|---|---|
| **CVSS** | 9.8 |
| **Vector** | Claude Code interpolated `git config user.email` into a shell command without sanitization. A malicious repo with a crafted `.gitconfig` achieves arbitrary command execution before the trust dialog. |
| **Impact (unmitigated)** | Arbitrary command execution as the user running Claude Code |
| **Reference** | [GitLab Advisory](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2025-59041/) |

### Attack chain vs. hazmat

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. User clones repo with crafted `.gitconfig` | Git email field contains shell metacharacters | Same |
| 2. Claude Code interpolates email into shell command | Injected command runs as primary user | Injected command runs as `agent` inside seatbelt |
| 3. Payload harvests credentials, installs persistence | **Succeeds** — full access to primary user's home | **Blocked** — agent cannot read `/Users/dr/`, credential paths denied at kernel level |

**Verdict: Strong mitigation.** Same analysis as CVE-2025-59536 — pre-trust
RCE is contained by user isolation regardless of the injection vector (project
files, git config, hooks).

---

## CVE-2026-21852 — API Key Exfiltration via Config Redirect

| | |
|---|---|
| **CVSS** | 5.3 |
| **Vector** | Malicious repository overrides `ANTHROPIC_BASE_URL` or uses crafted MCP/hooks configs to redirect API traffic, leaking the API key before any trust prompt |
| **Impact (unmitigated)** | Anthropic API key leaked to attacker-controlled endpoint |
| **Reference** | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-21852), [GitHub Advisory](https://github.com/advisories/GHSA-jh7p-qr78-84p7) |

### Attack chain vs. hazmat

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. User clones malicious repository | Repo contains config that redirects API base URL | Same — hazmat does not filter project content |
| 2. Initialization reads malicious config | `ANTHROPIC_BASE_URL` overridden to attacker server | Config affects the **agent user's** Claude instance only |
| 3. API key sent to attacker endpoint | **Primary user's API key leaked** | **Primary user's key never in scope.** Only the agent's own key is at risk |
| 4. Attacker uses stolen key | Full access to victim's Anthropic account | Access limited to the agent's API key — can be rotated independently |

### Layer-by-layer analysis

| Layer | Effect on this CVE |
|-------|-------------------|
| **User isolation** | Primary user's `~/.claude/settings.json` is inaccessible. The redirect only affects the agent's Claude config. |
| **env -i boundary** | Agent sessions start with a clean environment (`session.go:478`). Host `ANTHROPIC_BASE_URL` does not leak into the sandbox. |
| **Seatbelt** | Agent can read/write its own `~/.claude/` (needed for normal operation). A malicious project could write to the agent's Claude settings. |
| **pf firewall** | HTTPS to the attacker's server is allowed (port 443 is open by design). pf does not help here. |

**Residual risk:** The agent's own API key can be redirected and exfiltrated.

**Possible hardening:** Inject the API key via `env -i` at session launch
rather than storing it in the agent's shell profile. This removes the key from
disk in the agent's readable paths.

**Verdict: Partial mitigation.** The primary user's key is fully protected.
The agent's own key remains at risk — limited to one rotatable key.

---

## CVE-2026-25725 — Sandbox Escape via `settings.json` Injection

| | |
|---|---|
| **CVSS** | 8.8 |
| **Vector** | Malicious code writes to `~/.claude/settings.json` during a session. On next restart, injected settings (hooks, permissions) execute with host privileges, escaping the built-in sandbox. |
| **Impact (unmitigated)** | Full bypass of Claude Code's built-in sandbox |
| **Reference** | [GitLab Advisory](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2026-25725/) |

### Attack chain vs. hazmat

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. Malicious code writes to `~/.claude/settings.json` | Writes to primary user's settings | Writes to `/Users/agent/.claude/settings.json` only |
| 2. User restarts Claude Code | Injected settings load with host privileges | Next `hazmat claude` runs as `agent`, inside seatbelt, with pf rules — **same containment** |
| 3. Injected config achieves host-level execution | **Succeeds** | **Blocked** — no privilege escalation path from `agent` to `dr` |

**Why this is structurally mitigated:** Hazmat's containment is applied
externally (`sudo -u agent` + `sandbox-exec` + `pf`). None of these depend on
`settings.json`. Even if Claude's built-in sandbox is fully bypassed, the
agent is still a different OS user inside a kernel sandbox with firewall rules.

**Residual risk:** The agent could poison its own settings, but since hazmat
already uses `--dangerously-skip-permissions`, this is not a meaningful
escalation. Hazmat's OS-level containment is the real boundary.

**Verdict: Effectively mitigated.** The CVE's core payload — escaping to host
privileges — is structurally impossible under hazmat.

---

## CVE-2026-33068 — Trust Dialog Bypass via Repo-Controlled Settings

| | |
|---|---|
| **CVSS** | 8.8 |
| **Vector** | A repo-committed `.claude/settings.json` sets `permissions.defaultMode` to `bypassPermissions`, silently skipping the workspace trust dialog on first open |
| **Impact (unmitigated)** | Tool execution without explicit user consent |
| **Reference** | [GitLab Advisory](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2026-33068/), [RAXE Labs](https://raxe.ai/labs/advisories/RAXE-2026-040) |

### Attack chain vs. hazmat

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. User opens repo containing `.claude/settings.json` | Settings loaded from project directory | Same |
| 2. `bypassPermissions` mode activated silently | Trust dialog skipped, full tool execution | Trust dialog is irrelevant — hazmat already uses `--dangerously-skip-permissions` |
| 3. Attacker's instructions execute without confirmation | **Succeeds** — runs as primary user with no containment | Runs as `agent` inside seatbelt with pf rules |

**Why hazmat is unaffected:** Hazmat's threat model explicitly assumes the
agent has full permissions — that is the entire point of the tool. The trust
dialog and permission modes are Claude's inner safety layer. Hazmat's
containment layers (user, seatbelt, pf) are the actual boundary and are
independent of Claude's permission settings.

**Verdict: Effectively mitigated.** The bypass achieves what hazmat already
grants by design. The containment layers hold regardless.

---

## Command Parsing Bypass Family

Six CVEs share the same attack pattern: a parsing flaw in Claude Code's
command validation lets an attacker bypass the confirmation prompt to execute
commands or write files without user approval.

| CVE | CVSS | Specific bypass | Fixed in |
|-----|------|----------------|----------|
| [CVE-2025-54795](https://nvd.nist.gov/vuln/detail/CVE-2025-54795) | 9.8 | Echo command parsing error | 1.0.20 |
| [CVE-2025-58764](https://nvd.nist.gov/vuln/detail/CVE-2025-58764) | 9.8 | General command parsing error | 1.0.105 |
| [CVE-2025-66032](https://nvd.nist.gov/vuln/detail/CVE-2025-66032) | 9.8 | `$IFS` and short CLI flag parsing | 1.0.93 |
| [CVE-2026-24887](https://nvd.nist.gov/vuln/detail/CVE-2026-24887) | 8.8 | `find` command parsing error | 2.0.72 |
| [CVE-2026-25723](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2026-25723/) | 8.8 | Piped `sed` + `echo` bypass → file writes | 2.0.55 |
| [CVE-2025-64755](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2025-64755/) | 8.8 | `sed` command validation → arbitrary file writes | 2.0.31 |

### Common attack pattern

1. Attacker injects malicious content into Claude Code context window
   (via project files, MCP responses, or fetched web content)
2. Crafted command syntax exploits a parsing flaw in Claude's validation
3. Command executes without user confirmation prompt

### Hazmat defense (applies to all supported harnesses)

| Step | Without hazmat | With hazmat |
|------|---------------|-------------|
| 1. Malicious content injected into context | Same | Same |
| 2. Crafted command bypasses confirmation | Command runs as primary user | Command runs as `agent` inside seatbelt |
| 3. Command reads sensitive files | **Succeeds** — full filesystem access | **Blocked** — seatbelt default-deny policy. Only project dir, agent home subdirs, and system libraries are readable |
| 4. Command writes outside project | **Succeeds** — full filesystem access | **Blocked** — seatbelt allows writes only to project dir and approved agent home paths |
| 5. Command exfiltrates data | **Succeeds** — no network restrictions | **Partial** — pf blocks SMTP/IRC/FTP/Tor; HTTPS exfil still possible |

**Key insight:** The confirmation prompt is Claude's application-level safety
gate. Hazmat does not rely on it — hazmat uses `--dangerously-skip-permissions`
by design. The OS-level containment (user isolation + seatbelt + pf) is the
real boundary. These CVEs bypass the inner gate; the outer gate holds.

**For the file-write variants (CVE-2026-25723, CVE-2025-64755):** Even if
arbitrary file writes succeed, the seatbelt policy restricts writable paths to
the project directory, `/Users/agent/.claude/`, `/Users/agent/.local/`,
`/Users/agent/.config/`, `/Users/agent/.npm/`, and `/private/tmp`. Writing to
the primary user's home or system directories is blocked at the kernel level.

**Verdict: Strong mitigation.** The confirmation bypass is irrelevant under
hazmat's threat model. OS-level containment prevents the damaging follow-up
actions these bypasses would normally enable.

---

## Symlink Bypass Family

Two CVEs bypass Claude Code's application-level deny rules via symbolic links.

| CVE | CVSS | Description | Fixed in |
|-----|------|-------------|----------|
| [CVE-2025-59829](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2025-59829/) | 6.5 | Symlink follows past permission deny rules | 1.0.120 |
| [CVE-2026-25724](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2026-25724/) | 6.3 | Same class, second instance | 2.1.7 |

### Common attack pattern

1. A file that Claude Code is configured to deny (e.g., `/etc/passwd`,
   `~/.ssh/id_rsa`) has a symlink pointing to it in an accessible location
2. Claude Code checks the symlink path against deny rules — the symlink path
   is not denied, so access proceeds
3. The OS resolves the symlink, reading the actual denied file

### Hazmat defense

The symlink bypass is against Claude's **application-level** deny list, not
the OS-level seatbelt deny list.

| Layer | Effect |
|-------|--------|
| **User isolation** | Even if Claude's deny rules are bypassed, `/Users/dr/.ssh/` is owned by `dr`. The `agent` user has no read permission — symlink or not. |
| **Seatbelt** | The `(deny file-read* file-write* (subpath "/Users/agent/.ssh"))` rules are evaluated by the macOS kernel after symlink resolution. A symlink from `/tmp/link → /Users/agent/.ssh/id_rsa` still hits the deny rule because the kernel resolves the path before applying the SBPL policy. |
| **Layered defense** | Even if the seatbelt could be tricked (it cannot in this case), the Unix file permissions on the primary user's files are an independent barrier. |

**Verdict: Strong mitigation.** Hazmat's credential protection operates at
two independent levels (Unix permissions + kernel sandbox), neither of which is
susceptible to symlink tricks the way Claude's application-level deny list is.

---

## CVE-2026-24052 — Domain Validation Bypass

| | |
|---|---|
| **CVSS** | 6.5 |
| **Vector** | Claude Code used `startsWith()` to validate trusted domains, so `modelcontextprotocol.io.evil.com` passed validation for `modelcontextprotocol.io` |
| **Impact (unmitigated)** | Automatic requests to attacker-controlled domains without user consent, leading to data exfiltration |
| **Reference** | [GitLab Advisory](https://advisories.gitlab.com/pkg/npm/@anthropic-ai/claude-code/CVE-2026-24052/) |

### Hazmat defense

| Layer | Effect |
|-------|--------|
| **pf firewall** | Does not help — HTTPS (443) is allowed to all destinations by design |
| **DNS blocklist** | Only blocks exact-match known tunnel services. Novel attacker domains are not covered. |
| **User isolation** | Limits what data is available for exfiltration — only workspace and agent home, not primary user files |
| **Seatbelt credential deny** | Prevents exfiltration of credential files even if the request reaches an attacker domain |

**Residual risk:** The domain bypass lets Claude make HTTPS requests to
attacker-controlled servers. Under hazmat, the data available for exfiltration
is limited to workspace files and agent-readable paths — not the primary
user's credentials or home directory.

**Verdict: Partial mitigation.** Hazmat reduces the blast radius (what can be
exfiltrated) but does not block the exfiltration channel itself.

---

## CVE-2025-55284 — Permissive Default Allowlist

| | |
|---|---|
| **CVSS** | 7.1 |
| **Vector** | Claude Code's overly broad default allowlist of "safe" commands let attackers bypass the confirmation prompt to read files and exfiltrate their contents over the network |
| **Impact (unmitigated)** | Unauthorized file read and network exfiltration without user confirmation |
| **Reference** | [GitHub Advisory](https://github.com/advisories/GHSA-x5gv-jw7f-j6xj) |

### Hazmat defense

| Layer | Effect |
|-------|--------|
| **User isolation** | Only files accessible to the `agent` user can be read — primary user's home is inaccessible |
| **Seatbelt** | Default-deny policy. Only project dir, agent home subdirs, system libraries, and `/private/tmp` are readable |
| **Credential deny** | `.ssh`, `.aws`, `.gnupg`, Keychain, etc. denied at kernel level even within agent home |
| **pf firewall** | Exfiltration via non-HTTPS protocols blocked |

**Verdict: Strong mitigation.** The allowlist bypass grants "read any file the
user can access" — but under hazmat, what the agent can access is already
heavily restricted by seatbelt and user isolation.

---

## CVE-2025-52882 — WebSocket Origin Bypass (IDE Extensions)

| | |
|---|---|
| **CVSS** | 8.8 |
| **Vector** | Claude Code IDE extensions (VSCode, JetBrains) accepted WebSocket connections without origin validation. Visiting a malicious webpage could read files, execute code in notebooks, or access diagnostics. |
| **Impact (unmitigated)** | Arbitrary file read, code execution via notebooks, data access |
| **Reference** | [GitHub Advisory](https://github.com/advisories/GHSA-9f65-56v6-gxw7) |

### Hazmat defense

**Not directly applicable.** This CVE affects Claude Code's IDE extensions
(VSCode, JetBrains), not the CLI. Hazmat wraps the CLI via `hazmat claude` —
it does not modify or contain the IDE extensions.

If a user runs Claude Code through the IDE extension alongside hazmat, the
extension runs as the primary user and is **not** contained by hazmat's
layers.

**Verdict: Not applicable** to hazmat's CLI containment. Users running IDE
extensions should update to patched versions independently.

---

## Cross-Cutting Analysis

### What makes hazmat effective against these CVEs

All 16 CVEs share a common assumption: **the agent runs as the primary user.**
When that assumption breaks, the attacks degrade:

| Attack goal | Requires | Hazmat status |
|-------------|----------|---------------|
| Read primary user's SSH keys | Filesystem access to `/Users/dr/.ssh/` | **Denied** — user isolation + seatbelt credential deny |
| Read primary user's cloud credentials | Filesystem access to `/Users/dr/.aws/`, `~/.config/gcloud` | **Denied** — user isolation + seatbelt credential deny |
| Modify primary user's shell/git config | Write access to `/Users/dr/` | **Denied** — user isolation |
| Write arbitrary files on the host | Filesystem write to any path | **Denied** — seatbelt default-deny, writes limited to project + agent home |
| Exfiltrate via non-HTTPS protocols | Network access to SMTP, IRC, FTP, etc. | **Denied** — pf firewall |
| Bypass confirmation prompt | Claude's application-level safety | **Irrelevant** — hazmat uses `--dangerously-skip-permissions`; OS containment is the boundary |
| Bypass symlink deny rules | Claude's application-level deny list | **Irrelevant** — kernel seatbelt and Unix permissions are independent |
| Escalate from agent to primary user | Privilege escalation path | **No path exists** — sudoers is one-directional |
| Persist across primary user sessions | Write to primary user's config files | **Denied** — user isolation |

### Attack class summary

| Attack class | CVEs | Hazmat | Notes |
|-------------|------|--------|-------|
| Pre-trust RCE | CVE-2025-59536, CVE-2025-59041 | **Strong** | RCE executes but as `agent` user, not primary |
| Confirmation prompt bypass | CVE-2025-54795, CVE-2025-58764, CVE-2025-66032, CVE-2026-24887, CVE-2026-25723, CVE-2025-64755 | **Strong** | Prompt is irrelevant; OS containment holds |
| Symlink deny bypass | CVE-2025-59829, CVE-2026-25724 | **Strong** | Kernel seatbelt + Unix permissions are independent barriers |
| Sandbox/settings escape | CVE-2026-25725, CVE-2026-33068 | **Effective** | No escalation path from agent to primary user |
| API key / data exfiltration | CVE-2026-21852, CVE-2026-24052, CVE-2025-55284 | **Partial** | Primary user's credentials protected; agent's own key and workspace exposed |
| IDE extension (non-CLI) | CVE-2025-52882 | **N/A** | Hazmat wraps CLI only |

### What hazmat does NOT defend against

| Risk | Why |
|------|-----|
| Workspace file exfiltration over HTTPS | The agent needs both workspace access and HTTPS for normal operation |
| Agent's own API key leakage | The agent needs its key to authenticate; it must be readable |
| Prompt injection execution | Hazmat limits the blast radius of injected commands, not their execution |
| Novel domain exfiltration | pf blocks protocols, not destinations. HTTPS to any server is allowed |
| IDE extension vulnerabilities | Hazmat contains the CLI, not the IDE extension |

### Defense in depth

No single layer handles all CVEs alone. The protection comes from their
combination:

```
Pre-trust RCE (CVE-2025-59536, CVE-2025-59041):
  User isolation  ──── blocks credential access
  Seatbelt        ──── blocks credential file reads at kernel level
  pf firewall     ──── blocks exfiltration protocols
  DNS blocklist   ──── blocks known tunnel services

Confirmation bypass (6 CVEs):
  User isolation  ──── limits what bypassed commands can reach
  Seatbelt        ──── default-deny restricts file reads/writes
  (confirmation prompt is not the security boundary)

Symlink bypass (CVE-2025-59829, CVE-2026-25724):
  User isolation  ──── Unix permissions block cross-user reads
  Seatbelt        ──── kernel resolves symlinks before applying policy
  (two independent barriers, neither susceptible to symlinks)

Settings/sandbox escape (CVE-2026-25725, CVE-2026-33068):
  User isolation  ──── prevents cross-user settings writes
  External sandbox ─── containment doesn't depend on settings.json
  (OS containment is independent of Claude's permission modes)

Exfiltration (CVE-2026-21852, CVE-2026-24052, CVE-2025-55284):
  User isolation  ──── scopes to agent's key and workspace only
  env -i boundary ──── prevents host env var leakage
  (HTTPS channel remains open — by design)
```

---

## Recommendations

1. **Rotate the agent's API key periodically.** CVE-2026-21852 and
   CVE-2026-24052 show that the agent's own key is the weakest link. If
   compromised, only the agent key needs rotation — the primary user's key is
   never exposed.

2. **Review agent's `~/.claude/settings.json` after working with untrusted
   repos.** CVE-2026-25725 and CVE-2026-33068 can poison agent settings. Run
   `hazmat rollback` and re-setup if suspicious.

3. **Use `hazmat restore` after working with untrusted repos.** Snapshot
   rollback recovers from workspace modifications made by RCE or file-write
   payloads.

4. **Update Claude Code regularly.** While hazmat mitigates these CVEs, running
   patched versions eliminates the vulnerabilities at the source. The inner and
   outer safety layers are complementary.

5. **Do not rely on hazmat for IDE extension security.** CVE-2025-52882 affects
   IDE integrations. Update extensions independently.

6. **Consider injecting the API key at session launch** rather than storing it
   in the agent's shell profile, to reduce the file-based exfiltration window
   for CVE-2026-21852.
