Back to rankings

Claude Code Patches a Credential Upload Leak and a Session-Trust Gap

Claude CodeView original changelog

Claude Code 2.1.248 fixed two separate trust-boundary issues. First, /ultrareview and locally seeded cloud sessions were uploading uncommitted edits to sensitive files such as prod.env-style secrets and *.tfvars config, as well as editor swap, temp, and backup copies of credential files like key.pem.tmp or id_rsa.swo; those files now stay on the local machine instead of being sent to a cloud session. Second, Anthropic tightened cross-session messaging inside Linux user namespaces so that root-equivalent trust for unmapped owners is now limited to canonical system directories, closing a narrower privilege-escalation path.

Key Takeaways

  • Uncommitted secret-bearing files were being uploaded to the cloud by /ultrareview and locally seeded cloud sessions before this fix, with no indication to the user that it was happening.
  • The leak covered more than obvious .env files, extending to Terraform *.tfvars config and editor swap, temp, and backup copies of credential files such as id_rsa.swo.
  • Files now stay on the local machine rather than being shipped into a cloud session, closing the exposure without requiring any user action.
  • A second, narrower fix targeted Linux user namespaces, limiting root-equivalent trust for unmapped owners to canonical system directories.
  • Both fixes land in the same release as part of a broader pattern of permission and isolation hardening Anthropic has been shipping through August 2026.
  • Neither fix required a user opt-in, meaning affected users were protected automatically on updating rather than needing to change a setting.

Uncommitted Secrets Were Reaching the Cloud

Claude Code 2.1.248 closed a data-exposure path in /ultrareview and in cloud sessions seeded from a local checkout. Before the fix, uncommitted edits to files that commonly hold secrets, such as prod.env-style environment files and Terraform *.tfvars config, could be uploaded to a cloud session along with the rest of the working tree. The same was true of editor artifacts that often contain leftover credentials, including swap, temp, and backup copies like key.pem.tmp or id_rsa.swo. None of that was a deliberate feature: a developer running a review or launching a cloud session had no obvious reason to expect that an uncommitted, gitignored-looking file would leave their machine. With the fix, those files now stay local.

A Narrower Fix in Linux User Namespaces

The same release tightened cross-session messaging when Claude Code runs inside Linux user namespaces. Previously, an unmapped owner inside such a namespace could inherit a broader, root-equivalent level of trust than intended; that trust is now limited to canonical system directories. This is a narrower, more infrastructure-specific fix than the credential upload issue, but it follows the same pattern: something inside an isolated or sandboxed context was more trusted than a user would reasonably assume.

Why Both Matter Together

Anthropic has patched a steady stream of permission, sandbox, and isolation issues in Claude Code through August 2026, and this release adds two more to that list. The credential upload fix in particular is the kind of issue that could have silently exposed real secrets: a developer keeping a personal .env file uncommitted for convenience would not expect a review command to ship its contents into a cloud environment.