Claude Code Security: The Real Risks, and a Hardening Checklist You Can Finish Today

Claude Code is safe enough to use on real work, provided a person or a hard rule stands between it and anything irreversible. It runs commands, edits files and reads the web with your user's permissions, so the risks are practical: instructions hidden in what it reads, secrets it can reach, repositories you did not write, MCP servers, and approvals you gave once and forgot. To secure Claude Code, deny reads of .env and credential files, turn on the sandbox, keep approval on pushes and network commands, never use bypass mode outside a container, approve MCP servers one at a time, keep it updated, and screen its traffic.

Below is each risk in plain English, then a hardening checklist in seven parts. Everything was checked against Anthropic's Claude Code documentation and its published security advisories on 23 September 2026; Claude Code moves quickly, so confirm settings with /status on your version.

Is Claude Code safe out of the box?

Mostly. In Manual mode (config value default), Claude Code starts read-only and asks before it edits a file, runs a command that can change your system or makes most network requests. It can only write inside the folder you started it in. Web fetches run in a separate context window. A new folder or MCP server has to be trusted before it loads.

Two things change that picture. On Pro, Max and Team plans the built-in starting mode is now auto mode, where a classifier model approves actions instead of you. It blocks a documented list of risky actions and never sees tool results directly, but it is still a model's judgement, not a rule you wrote. And every "Yes, and don't ask again" stays given; after a few weeks most setups are far more permissive than their owners think. As Anthropic's security page puts it, no system is completely immune to all attacks.

Claude Code security risks in plain English

1. It acts as you. Every command Claude Code runs has your user's permissions. If you can delete a folder or push to a repository, so can it. Permission prompts are the brake; the risk is how often we wave them through.

2. Text it reads can steer it. This is prompt injection: a web page, a GitHub issue, a README, a PDF or an MCP tool result contains instructions, and the model treats them as part of its job. The indirect version, arriving through a tool rather than your prompt, is the one that matters for coding agents. Anthropic's advice: avoid piping untrusted content straight into Claude, and use a VM when working with external web services.

3. Secrets are within reach. Your .env sits in the project folder, your cloud and SSH keys in your home folder. Anthropic's sandbox docs say it plainly: by default, sandboxed commands can read the entire computer, including ~/.aws/credentials and ~/.ssh/.

4. Repositories you did not write. A project can ship its own .claude/settings.json, hooks and .mcp.json servers. Hooks are shell commands that run automatically at set points, and Anthropic's docs list hooks in project settings as content that is used even when you trusted only a parent folder or ran claude -p. Starting Claude Code in a stranger's repository is closer to running their code than to reading it.

5. MCP servers. Each server adds tools, tool descriptions and tool results to Claude's context, and a local server is a program running with your permissions. Anthropic reviews connectors before listing them in its directory, but says it does not security-audit or manage any MCP server. Our MCP security checklist covers the server risks in detail; we will not repeat it here.

6. Bypass mode. --dangerously-skip-permissions starts Claude Code in bypassPermissions, which skips prompts, including for writes to .git and .claude. Anthropic's advice is to use it only in isolated environments like containers or VMs. Even in a dev container, their docs warn that a malicious project can exfiltrate anything accessible inside it, including the Claude Code credentials in ~/.claude.

7. The tool has bugs, like every tool. Anthropic has published 30 security advisories on the Claude Code GitHub repository between June 2025 and June 2026, 24 rated high. The patterns repeat: commands slipping past the approval prompt, sandbox escapes, and repository settings acting before the trust dialog. Two are worth knowing: in CVE-2026-33068 a repository could set permissions.defaultMode to bypassPermissions in its committed settings and skip the trust dialog; in CVE-2026-21852 a repository could set ANTHROPIC_BASE_URL to an attacker's server and leak API keys before you confirmed trust. All are fixed through auto-update. Keep it on, and read a strange repository's .claude folder before trusting it.

8. What leaves your machine. Whatever Claude reads, secrets included, travels to the model in the next request. Nothing in the default setup checks that traffic for injected instructions or outgoing credentials. That is the gap a screening gateway fills.

How the permission system works, in one minute

Two layers decide what Claude Code can do without asking.

The mode sets the baseline. Manual asks before most actions; acceptEdits approves file edits in the working directory; plan explores without editing; auto has the classifier review actions; dontAsk denies anything not pre-approved, which suits CI; bypassPermissions skips prompts. Switch with Shift+Tab.

Rules sit on top. allow, ask and deny lists in a settings file name a tool and optionally a pattern: Bash(npm run test *), Read(./.env), WebFetch(domain:github.com). Rules are checked deny first, then ask, then allow, and the first match wins. A deny at any level cannot be overridden by an allow at another. Deny rules apply in every mode, including bypass. One line from the docs is worth pinning to the wall: permission rules are enforced by Claude Code, not by the model. Writing "never read .env" in your CLAUDE.md is a request; a deny rule is a rule.

Where rules live. From highest to lowest: managed settings (your organisation's), command-line flags, .claude/settings.local.json (you, this project), .claude/settings.json (committed, everyone in the project) and ~/.claude/settings.json (you, every project). Run /permissions to see what is actually in force.

The hardening checklist: how to secure Claude Code

One line of why per item. The first two parts matter most.

Permissions and allowlists

• Audit what you already approved. Run /permissions and remove broad allow rules you do not remember adding.
• Allow narrowly. Bash(npm run test *) is an allowlist entry; Bash on its own is a blank cheque.
• Put an ask rule on anything that leaves the building. Bash(git push *) still prompts even in the sandbox's auto-allow mode, which is where you want the last look.
• Deny network commands you do not need. Anthropic suggests denying curl and wget and allowing specific domains through WebFetch(domain:...); a deny rule matches the command as written, so pair it with the sandbox.
• Lock bypass mode. permissions.disableBypassPermissionsMode set to "disable" works from any settings file, including your own.
• Start risky work in plan mode. Reviewing a stranger's pull request needs reading, not writing.

Sandboxing

• Turn it on. Run /sandbox and pick auto-allow or regular permissions. It uses Seatbelt on macOS and bubblewrap plus socat on Linux and WSL2; native Windows is not supported, so run Claude Code inside WSL2 there.
• Close the escape hatch. By default a command that fails in the sandbox can be retried outside it after a prompt; "allowUnsandboxedCommands": false makes the sandbox strict.
• Know what it covers. Bash, PowerShell and Monitor commands and their child processes. The built-in Read, Edit and Write tools use permission rules instead, so you need both.
• Use a dev container or VM for unattended runs. Anthropic's reference dev container adds an egress firewall; that is the only place --dangerously-skip-permissions belongs.

A starting point for ~/.claude/settings.json, using only documented keys:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)", "Bash(curl *)", "Bash(wget *)"],
    "ask": ["Bash(git push *)"],
    "disableBypassPermissionsMode": "disable"
  },
  "sandbox": {
    "enabled": true,
    "allowUnsandboxedCommands": false
  }
}

Merge it into any existing blocks rather than adding a second permissions key, then run /status to confirm the file loaded.

Secrets

• Deny reads of secret files. Read(./.env), Read(./.env.*) and Read(./secrets/**) are Anthropic's own examples.
• Know the limit of that rule. Read deny rules cover Claude's file tools, file commands it recognises in Bash such as cat and sed, and redirects. They do not cover a Python or Node script that opens the file itself; the sandbox does.
• Hide home-folder credentials from sandboxed commands. sandbox.credentials denies reads of credential files and unsets secret environment variables before each command.
• Keep keys out of committed settings. Personal keys belong in ~/.claude/settings.json or an untracked .claude/settings.local.json, never in the project's .claude/settings.json.
• Use short-lived, narrow tokens. A repository-scoped token that expires is a smaller loss than your main key.

MCP servers

• Approve project servers one by one. Claude Code asks before connecting servers from a project's .mcp.json; read the list before you accept, and use claude mcp reset-project-choices if you approved too quickly.
• Be careful with headless runs. In claude -p, SDK and cloud sessions there is no prompt, so project servers load without asking; enabledMcpjsonServers, disabledMcpjsonServers or --strict-mcp-config put you back in control.
• Everything else is in the MCP checklist.

Hooks

• Read a repository's hooks before you trust it. /hooks shows every configured hook and which settings file it came from.
• Turn them off for untrusted runs. Pass --settings '{"disableAllHooks": true}'; Anthropic notes that setting it in your user settings alone is not enough, because project settings take precedence and can set it back.
• Use hooks as a guard. A PreToolUse hook that exits with code 2 blocks the call even when an allow rule matches. Teams can set allowManagedHooksOnly in managed settings to block user, project and plugin hooks.

Network

• Allow domains, not the internet. Sandboxed commands start with no domains allowed and prompt for each new one; allowedDomains pre-approves the few you need, and strictAllowlist denies the rest instead of asking.
• Keep the allowlist short. Anthropic warns that broad domains such as github.com can become exfiltration paths, and that the sandbox proxy decides on the hostname without inspecting encrypted traffic.
• Only set ANTHROPIC_BASE_URL yourself. Put it in your user settings, never accept it from a repository: CVE-2026-21852 is exactly this move. If a project's settings change where your traffic goes, stop and read why.

Screening

• Screen the traffic, including tool results. Everything above limits what Claude Code can reach; none of it reads the text passing to and from the model, where injected instructions and leaking credentials show up.
• Keep a record you did not write. When something goes wrong, you want an audit trail of what was sent and returned, kept outside the tool.

Where a gateway fits, and where it does not

Your assistant reads the web. The web can contain instructions. You cannot tell the difference, and neither can the model. That is the case for putting something in the path.

We use Constellation Gate AI for this (our review; setup and pricing on our Gate page). Affiliate link: we earn a commission on Pro seats that start from our link, which funds the testing and has no say in the verdict. Gate calls itself "the accountability layer for AI" and sits "between your agent and the model". It screens every request and response, including indirect injection hidden in tool output. On Pro it also detects credentials and secrets about to leave, redacts personal data, and sets spend limits per key. Every plan keeps a hash-chained audit log.

Gate's published figure is 95.4% of injection attacks caught at a false-alarm cap of 1 in 100, with a median 53 milliseconds added (vendor figures, arXiv:2606.02959, checked 23 September 2026). A strong screen, not a guarantee.

Setup is in our Claude Code proxy guide: ANTHROPIC_BASE_URL pointing at Gate, with the Gate key and upstream address in ANTHROPIC_CUSTOM_HEADERS (X-Gate-Api-Key, X-Gate-Upstream-Url). No Anthropic credential variable is set, so your subscription stays your login and its usage limits still apply. Two trade-offs: Remote Control is off while the base URL is not Anthropic's, and in auto mode behind any gateway Anthropic's docs say Claude Code may fall back to its own classifier requests, billed on some accounts, with a notice when it does.

Now the plain part. Gate is the traffic layer only. It does not sandbox Claude Code, restrict which files it can open, stop a command from running or review your code. A command that deletes a folder never passes through the model traffic, so no gateway sees it. Permissions, the sandbox and secret handling above stay yours. For how gateways compare with guardrail libraries, see AI firewall vs LLM guardrails.

Free records, Pro blocks. The free plan is $0 with 20,000 recorded requests a month and a basic pattern-based injection screen, so you can see what Claude Code's traffic looks like. Full screening with blocking, credential and PII redaction and spend limits is Pro, at $20 per user per month. Start free →

What Codex Security scans (your code) vs what a gateway screens (your agent's traffic)

If you searched for "codex security", you may have wanted OpenAI's product of that name. We cover it in the same terms in our Codex CLI proxy guide.

Codex Security is OpenAI's application security agent, in research preview since March 2026, with an open-source CLI at @openai/codex-security. It connects to your repositories, builds a threat model of your code, confirms vulnerabilities and proposes patches for review. It looks at your code. On the Claude side, the closest built-in equivalent is the /security-review command, which runs a security pass over the changes on your current branch.

A gateway looks at your agent's traffic: what Claude Code or Codex sends to the model and what comes back, screened for smuggled instructions, credentials about to leave and personal data, and logged. Codex Security will not notice an injection in an issue your agent read; a gateway will not find a SQL injection in your handler; neither is a permission system or a sandbox. Our prevention guide ranks the layers by what they stop. For the wider risk map, see the OWASP LLM Top 10 in plain English.

Your first fifteen minutes

This follows the method from how to actually use the tools you pay for: one task, one sitting, something done at the end.

1. Minutes 0 to 3: the audit. Open Claude Code in your main project. Run /permissions and delete any allow rule you cannot explain. Run /status and note your version and which settings files loaded.
2. Minutes 3 to 7: the secrets. Add the deny rules from the settings block above to ~/.claude/settings.json. Ask Claude to read your .env; it should be refused.
3. Minutes 7 to 10: the sandbox. Run /sandbox, turn it on, and set allowUnsandboxedCommands to false. On Linux or WSL2, install bubblewrap and socat first if the panel asks.
4. Minutes 10 to 12: the repository check. Run /hooks and claude mcp list. Anything you did not add yourself, read before your next session.
5. Minutes 12 to 15: the screen. Put Gate on the free plan in front of Claude Code and set a reminder for a week from now to look at what it flagged.

Output: dangerous verbs behind a rule, a sandbox around your commands, and a week of recorded traffic to decide whether blocking is worth $20. Leave auto-update on. That is the whole job.

Sources: Claude Code documentation at code.claude.com: "Security", "Configure permissions", "Choose a permission mode", "Configure the sandboxed Bash tool", "Settings files and precedence", "Hooks reference", "Connect Claude Code to tools via MCP" and "Development containers"; the Claude Code security advisories on GitHub (anthropics/claude-code, including CVE-2026-33068 and CVE-2026-21852); OpenAI's Codex Security documentation and research-preview announcement; Constellation Gate AI documentation and arXiv:2606.02959. All checked 23 September 2026.