Claude Code write-time symlink race escaped the project path

A workspace writer could redirect a previously checked Claude Code edit outside the project by replacing its target with a symlink before the write occurred. Anthropic's advisory identifies CVE-2026-103435, affects versions before 2.1.129 and requires the attacker to win a local timing race.

Claude Code checked whether the proposed target lay inside the project when it evaluated permission. It later resolved the path again during the write. If a different process changed what that path referred to between those operations, the earlier decision no longer described the actual destination. The resulting write used the agent session's available privileges, which could exceed those of the attacker modifying the shared workspace.

The missing protection was continuity between the checked object and the object ultimately written. A legitimate request to edit a project file could therefore produce an unintended filesystem effect without a malicious model instruction. This differs from an anonymous remote takeover: the advisory requires shared-workspace write access as well as favorable timing, and does not report a confirmed victim or damaged file.

Anthropic lists 2.1.129 as the patched version and says standard auto-update users had received the correction. That vendor statement establishes a released repair, not verification that every installation has upgraded. The case illustrates why a permission check must remain valid when the filesystem action takes place.