Claude Code

Sources: claude-code (GitHub) · Claude Code documentation · npm download volume, 2026-07-28 to 2026-08-27

Anthropic’s terminal-resident coding agent, published on npm as @anthropic-ai/claude-code and wrapped for continuous integration by a first-party GitHub Action. Manifold Security cites over 77 million npm downloads across the 31 days ending 2026-08-27 for the package, the only distribution figure it gives for any agent in its GitSpawn set; the count bounds distribution rather than installed base, because it includes mirrors, re-installs and continuous-integration fetches.¹

The coding agent is distinct from Claude Code Security, a separate Anthropic product that reads and reasons about codebases for vulnerability discovery.

Four surfaces matter here.

As a configuration tree. The harness reads a workspace-local .claude/ directory and a user-level ~/.claude/ tree carrying hooks, MCP server manifests, subagents, slash commands, skills and instruction files. That tree is the original worked instance of harness config as supply-chain artifact, and AgentShield’s rule corpus is tuned to its shape.

As an enforcement surface. Claude Code exposes hooks that run in path around tool calls, and Uber’s ADR deployment uses them for real-time blocking of high-severity credential leakage while its sensor reconstructs sessions from the local caches the harness writes. Inline Gateway vs Runtime Instrumentation carries the architectural argument that deployment settles.

As a CI-runner agent. The GitHub Action places the harness in the CI-runner variant of Generative Coding Deployment Shapes, where no human is positioned to see an action before it executes. Microsoft Defender research extracted a model API key from that shape through an HTML-comment injection in a pull request, reaching /proc/self/environ past a shell-only sandbox boundary.

As offensive tooling. Two catalogued campaigns drove the agent against third-party targets: GTG-1002, where it orchestrated reconnaissance and intrusion across roughly thirty targets, and the Mexican government multi-agency breach, where it carried about 75 percent of the operator’s remote command execution.

Security Record

Date	Item	Reported effect
2026-06-05	GitHub Action credential exposure	Model API key extraction from a CI workflow; unsandboxed file-read tool
2026-09-01	GitSpawn startup `core.fsmonitor` execution	Host command execution before the workspace-trust prompt; patched in 2.1.196
2026-09-01	GitSpawn `ultrareview` execution	Host command execution on start-up through an undisclosed git config key; unpatched at 2.1.252 as of that date

sandbox-runtime` is Anthropic’s whole-process wrapper for closing the coverage asymmetry the first of those findings exploited. Neither it nor the hook surface sits on the path of the context-gathering subprocess the GitSpawn findings use, because that subprocess belongs to the harness rather than to a tool call.

Notes

Footnotes

1. npm registry downloads API, @anthropic-ai/claude-code, 2026-07-28 to 2026-08-27. Package downloads over a 31-day window, the endpoint cited by Manifold Security for the figure. ↩