Disclosed weakness · no CVE recorded

Cloud artifacts could change without the expected permission check

Anthropic · Claude Code · Artifact tool and subagent uploads

First documented disclosure · Review checkpoint

Summary

Some cloud sessions skipped deny rules, prompts or hooks for the Artifact tool. Subagents could also reuse an earlier approval when modifying or uploading to an externally visible artifact.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The vendor release notes report a fix and identify no exploitation against users.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Some cloud sessions skipped deny rules, prompts or hooks for the Artifact tool. Subagents could also reuse an earlier approval when modifying or uploading to an externally visible artifact.

Conditions required

An affected cloud session or subagent has access to the artifact. The upload case involves an allow rule or previous approval.

Potential impact

Content visible outside the organization could be changed or uploaded without a fresh approval.

Affected versions and configurations

Anthropic did not publish the earliest affected version.

Fix and mitigation status

Anthropic lists the correction in 2.1.325.

Practical next steps

Update Claude Code to a supported release containing the 2.1.325 correction.

Operating lesson

Review externally shared artifacts and audit historic uploads where subagents had write access.

Evidence and limits

The November 13 release provides no issue-specific CVE or severity. Its change to the default approval flow for sandboxed Bash is documented separately.

Sources