Claude Code: Project hooks could run before the trust prompt

What Anthropic reported

In an engineering article published May 25, 2026, Anthropic said it had received three responsible-disclosure reports between mid-2025 and January 2026 about Claude Code processing project input before the user trusted the folder. In its example, a cloned repository contained a .claude/settings.json hook. Claude Code loaded project settings before showing its trust prompt, so the committed hook could execute before consent. Anthropic said the other reports similarly involved parsing project input before establishing trust. It fixed these cases by delaying parsing and execution of project-local configuration until after the user accepted the prompt. The article gives no exact report, incident, or fix dates, CVEs, or affected-version ranges, and does not report these vulnerabilities as exploited in the wild.

What Mac users can take away

When reviewing an unfamiliar repository on a Mac, ask what can run before you approve the project and what local data the agent can reach afterward. Review project-level automation, use an isolated workspace when uncertain, and keep credentials outside the agent’s accessible files unless the task needs them.

One useful workflow is to separate inspection from execution. Open an unfamiliar repository in a disposable workspace without broad credentials, review its hooks and startup configuration, then grant specific file or network access only when a task requires it. If a code review does not need internet access, leave it disabled during inspection. Trust prompts work best when they describe the capability being granted, so the user knows what approval covers. Keeping a short record of trusted projects and their needed permissions also makes new access easier to notice.