The Guardrail Watched the Wrong Door: Session Inception Smuggled a Hook Past Claude Code in a Child Session

2026-11-02 Agent & Supply Chain Security by al-ice.ai Editorial

Straiker’s STAR Labs published Session Inception in October 2026: a Claude Code attack in which a parent session launches a child Claude session inside a malicious repository, and the child takes a different permission path — letting a SessionStart hook run automatically and quietly send data from the developer’s machine to an attacker-controlled server, without the confirmation the parent path would have required. Researcher Jesus Padilla Soqui found the issue on 27 August, reported it to Anthropic via HackerOne on 17 September, and Anthropic closed it as “Informative” the same day, treating trust in repository settings as part of the user’s own workspace-trust decision. The parent’s guardrails worked as designed. The outcome simply arrived by a route where they never fired.

Three failures, then the fourth path

The attack starts mundanely: follow this README and test it. The malicious repo looks like a small Claude Code testing tool — clone it, ask Claude to summarize a throwaway dragon story in Markdown. Cloning it, or asking an open session to read the file, triggers nothing. The trick is the README’s suggested command, claude “summarize this repository md”, which starts a brand-new Claude Code session inside the repo folder — and only a new session there loads its hidden .claude/settings.json. Three approaches died on the guardrails first. Malicious settings alone still hit the workspace confirmation prompt. Pre-trusting the attacker’s domain failed because Claude read the quiz-game code, flagged the remote fetch-and-run as RCE risk, and refused. And the built-in directory-switch tool demands a fresh confirmation every call, even for approved folders. The fourth attempt skipped Desktop Code’s session switching entirely and ran the CLI through its own shell: cd [repo] && claude -p “summarize this repository md”. A separate process, launched from inside the repo’s folder, so the repo’s settings apply to it — chain complete: Desktop Code → Bash → Claude CLI → new session → settings → hook → attacker script → data out.

The check was tied to a path, not the outcome

Straiker is careful on this point and so should we be: calling it a “confirmation bypass” misdescribes it. The workspace-trust confirmation worked fine on the path it was built for — asking Desktop Code to switch folders. The gap is that the check guarded one route to an end state (a new session running inside an untrusted repository) while a second route to the identical end state had no checkpoint. The dangerous state was the same; only the road differed, and one road was unguarded. For the proof of concept the hook launched an attacker-server script that collected Bash environment data and sent it to the researchers — environment theft chosen to prove the point, while the underlying primitive is arbitrary command execution during session initialization, reusable for any post-compromise action the local user could take.

Hidden from humans, late to the model

Two delivery tricks aimed at reviewers rather than the model: User-Agent gating, where opening the link in a browser shows harmless content but a tool like curl receives the real payload, and a payload living in a DNS TXT record — decoded and piped into bash only after resolution, invisible to scanners that check files and URLs. Straiker’s prevalence sampling gives the blend-in argument its weight: of roughly 67,000 Claude Code configuration files on GitHub, about 5,000 contain active SessionStart hooks, roughly one in thirteen — nearly all benign environment checks and project-context loaders. A malicious hook does not have to look unusual; it can look exactly like the other twelve. And Claude did eventually notice: it flagged that a hook had run and saved a file and tried to investigate further — but was stopped, with the data already gone. Detection, not prevention.

Not prompt injection — and not counted anywhere

The repo contains text meant to influence Claude, and Claude spotted it and correctly ignored it as untrusted. The attack never needed the model to believe anything was safe; it needed the agent to trust the configuration, so the unsafe action happened as normal agent operation. That distinction matters because the industry’s counting machinery is tuned to the other question. Anthropic’s Informative closure means no CVE, no advisory, no scanner signature — the same invisibility pattern as OpenCode’s silent MCP OAuth RCE fix, shipped as a refactor with no CVE and the Copilot CLI encrypted-prompt chain GitHub validated but declined to treat as a vulnerability. Three different vendors, three different agent flaws, zero scanner rows between them. Guardrails that protect only the session where the agent starts do not hold when agents launch new sessions and create new execution paths — and spawning sessions through the shell is normal agent behavior, adjacent to the Downloads-folder config plants and hijacked assistant configs that abuse the same workspace trust.

What to actually do

Review .claude/settings.json — especially SessionStart hooks — in every repository before a session starts inside it. Cloned-repo config is untrusted input.
Watch for agents spawning CLI sessions through the shell (claude -p and equivalents). Alert on session-spawning commands whose working directory is a freshly cloned or unreviewed repo.
Constrain what hooks can do at minimum: hooks that exfiltrate environment data need no network. Egress-allowlisting developer machines bounds the whole class.
Treat “closed as Informative” as a coverage gap, not a clean bill of health. Inventory Claude Code installs and hook configurations directly — no scanner will flag this for you.

Our verification was read-only. We read the full Straiker STAR Labs Session Inception report first-hand (Jesus Padilla Soqui; found 27 August 2026, reported via HackerOne 17 September 2026, closed Informative the same day, published October 2026: four-attempt chain, exact child-session command, User-Agent gating and DNS TXT payload hiding, ~67,000-config / ~5,000-hook prevalence figures, late-detection account, non-prompt-injection analysis quoted above). The Anthropic disposition and timeline are the researchers’ account, carried with attribution. We cloned nothing, spawned no session, wrote no hook, and contacted no vendor. Brave Search was used for discovery only; the November 2026 Adversa roundup that surfaced this story is carried by URL in sources.

Sources: