Vulnerability / research

Untrusted resume input enables command execution through Claude Python SDK

Reported

What happened

Applications forwarding attacker-controlled session identifiers to the Python SDK could let CLI flags replace the intended resume value. Anthropic reports that this could start an unauthorized MCP process outside SDK permission controls.

Parties and reporting

AI tools and systems: Claude Agent SDK for Python, Claude CLI, Model Context Protocol

Outcome

Version 0.2.121, released July 17, binds session values to their options. Anthropic recommends upgrading; the advisory documents no observed exploitation or victim breaches.

Operating lesson

Upgrade the SDK, validate externally supplied session identifiers, and review process startup paths as well as agent tool permissions.

Evidence and limits

July 15 dates the public argument-injection discussion. Its initial assessment was narrower than the September 12 advisory, which describes command execution through MCP configuration. October 16 is database ingestion. Exploitation requires an application to accept untrusted resume input; this is not a confirmed Claude service breach.

Sources