An application using the Python Claude Agent SDK could allow an external party to select a previously recorded session, then pass that identifier into the SDK's resume option. The vulnerable path forwarded the value into a Claude CLI invocation without preventing a leading hyphen from being treated as an option. A specially shaped identifier could therefore…
Case · DiggingBeagle record
Claude Agent SDK resume identifier became an MCP startup option
An untrusted resume string was forwarded to the Claude CLI without preventing option interpretation; a crafted value could configure an executable stdio MCP server before agent tool approval.
Scope
CVE-2026-96620 / GHSA-h4mw-j7qp-8mwm, affected claude-agent-sdk Python <0.2.121; test application controlled resume path.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The reviewed advisory specifies an attacker-controlled resume identifier, leading option interpretation, executable stdio MCP configuration and the 0.2.121 fix. It does not establish that every application accepts external session identifiers or that real customer machines were compromised. The mechanism is a documented conditional demonstration.
Assessed Oct 18, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP13-RESUME-ARG · CLM-CP13-RESUME-FIX · CLM-CP13-RESUME-LAUNCH · CLM-ENRICH-RESUME-TRUST-BOUNDARY · GHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injection
At a glance
A model that refuses malicious requests does not defend executable processes launched while the harness is starting. Validating identifiers and assembling subprocess argv correctly is independent of permissions imposed later on tool calls. The plugin hash pin case concerns checked-out object identity after installer invocation, so its patch does not fix CLI…
Read the implicationsNo verified production exploitation or affected application count. Applications which never accept external resume identifiers may not expose the vulnerable code path.
Limits and uncertaintyFull account
An application using the Python Claude Agent SDK could allow an external party to select a previously recorded session, then pass that identifier into the SDK's resume option. The vulnerable path forwarded the value into a Claude CLI invocation without preventing a leading hyphen from being treated as an option. A specially shaped identifier could therefore select a custom MCP configuration rather than merely naming a session.
A stdio MCP server defined in that configuration can be started during CLI initialization. This timing matters: the process may launch before the agent receives a tool result, decides whether to call a tool or asks a user for normal runtime tool permission. The security boundary crosses from untrusted application input into startup process arguments. It is neither an instruction embedded in an external document nor proof that a compliant model deliberately ran a forbidden command.
The GitHub-reviewed advisory identifies Python SDK versions before 0.2.121 as affected, with 0.2.121 patched. Exploitation still requires a vulnerable application to accept attacker-influenced resume identifiers. A default SDK installation without that input path is not demonstrated to be remotely exploitable by the report. Validation should check that a resume value remains opaque session data through the final CLI parsing layer, and that no unapproved MCP process starts during application bootstrap.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
- 04
Step
Claims & evidence
CLM-CP13-RESUME-ARGThe SDK forwarded an untrusted resume session value to CLI arguments, permitting leading flag interpretation such as MCP configuration selection.supported
Basis: reported finding
- supportsGHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injectionprimary disclosure
GHSA vulnerability details and argument passing
CLM-CP13-RESUME-FIXThe vendor advisory identifies versions before 0.2.121 as affected and version 0.2.121 as patched.supported
Basis: reported finding
- supportsGHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injectionprimary disclosure
GHSA affected and patched versions
CLM-CP13-RESUME-LAUNCHUnder the documented application and flag-precondition, an attacker-selected stdio MCP command starts at CLI bootstrap before runtime model tool approval.supported
Basis: reported finding
- supportsGHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injectionprimary disclosure
GHSA impact and MCP startup sequence
CLM-ENRICH-RESUME-TRUST-BOUNDARYThe documented exploit requires an application to accept an attacker-selected resume value; it is not a default unauthenticated attack on every SDK deployment.supported
Basis: reported finding
- supportsGHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injectionprimary disclosure
GitHub advisory GHSA-h4mw-j7qp-8mwm, description and attack preconditions
Implications
A model that refuses malicious requests does not defend executable processes launched while the harness is starting. Validating identifiers and assembling subprocess argv correctly is independent of permissions imposed later on tool calls. The plugin hash pin case concerns checked-out object identity after installer invocation, so its patch does not fix CLI option injection.
Controls and mitigations
- Upgrade the Python Claude Agent SDK to 0.2.121 or later and reject externally supplied resume values that do not conform to actual session identifiers.
- Audit other SDK-to-CLI argument forwarding and require explicit trusted approval before launching repository- or session-selected MCP servers.
Unknowns and contradictions
- No verified production exploitation or affected application count.
- Applications which never accept external resume identifiers may not expose the vulnerable code path.
Sources and citation
Material revision history
- Oct 18, 2026 · Canonical change recorded · new in release · revision 171