The report
Opening an attacker-controlled repository could have launched a malicious executable in Claude Desktop on Windows, without the model issuing a dangerous command. Anthropic disclosed the search-path defect on October 13 and lists Claude Desktop 1.8089.0 as the first patched version.
The vulnerable project-open path called git.exe through uv_spawn without specifying the trusted executable location. Windows could search the current working directory first. If a repository contained an attacker-supplied binary with that name, opening the project could execute the repository's code using the user's privileges. The user still had to open the project, but neither a prompt injection nor an explicit decision to run the binary was needed. Anthropic lists versions before 1.8089.0 as affected and says standard auto-update users have received the fix; manual-update users should update.
The dangerous choice happened before an agent tool call
This is a desktop trust-boundary failure rather than a failure to evaluate the semantics of a model-authored shell command. A rule that blocks suspicious Bash requests cannot protect a normal application startup routine that selects an executable from untrusted project contents. The protection must instead bind the executable name to a trusted path before process creation and apply that rule to the relevant operating-system resolution behavior.
The technical Case retains the prerequisite of an attacker-controlled repository and the affected Windows versions. No exploitation campaign or victim total was established in the advisory. A useful regression check is to open a controlled repository containing a harmless marker named git.exe and confirm that no repository-local binary executes. Related agent tools and launch phases would need independent coverage; one patched subprocess does not certify every executable lookup in the desktop client.