Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

InversePrompt: path-restriction bypass and command injection in Claude Code

AIR-2025-0079 AIR record · 2025-08-claude-code-inverseprompt
Open in dashboard About
From the supporting source
Improper input sanitization in how Claude Code handles whitelisted commandscymulate.com
The record
Disclosed
2025-08-05
Vendor
Anthropic
Product
Claude Code
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted — the agent executed commands past its path restriction
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious prompt or repo content
Impact type
Remote code execution, Unauthorized file access
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Code before v0.2.111 (path bypass) and before v1.0.20 (command injection)
Capability abused
shell_executionfilesystem_accesscommand_allowlisting
Defense & remediation
Recorded defense
working-directory containment plus a whitelist of pre-approved commands
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
v0.2.111 (canonical path comparison) and v1.0.20 (input sanitization and granular command validation)
Taxonomy & references
OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI05 Unexpected Code Execution (RCE)CVE-2025-54794CVE-2025-54795prefix_path_validation_flawcommand_injectionallowlist_bypasssandbox_escape
Curator notes
Elad Beber, Cymulate. CVE-2025-54794 (CVSS 7.7) defeats a naive startsWith prefix check with a sibling directory sharing the approved prefix. CVE-2025-54795 (CVSS 8.7) breaks out of the whitelisted 'echo' command to run arbitrary shell with no user confirmation. Named 'InversePrompt' because Claude itself was used to reverse-engineer its own guardrails.
Supporting sources
Cite as
Enkrypt AI. "InversePrompt: path-restriction bypass and command injection in Claude Code". AIR, AIR-2025-0079. https://agentincident.vercel.app/i/AIR-2025-0079/ (accessed 2026-10-19).