Security scanner auditing Claude Code environments for CVE-2026-21852 pre-trust execution, hook hijacking, and eBPF lockdown.
A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 (pre-trust execution surfaces), hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration vectors.
📖 Canonical Security Disclosure & Audit:
Read the complete 25-vector penetration teardown:
👉 Claude Code Token Compromise & Hook Hijacking: Auditing CVE-2026-21852 at EyesTech Systems Lab.
Scan your workspace or cloned repository before launching agentic coding sessions:
git clone https://github.com/abhishek2512mishra/claude-code-security-audit.git
cd claude-code-security-audit
python audit_hooks.py /path/to/project
To generate the recommended eBPF network isolation rules:
python audit_hooks.py /path/to/project --gen-ebpf
If you cite this audit or use this scanner in security research:
@misc{rostova2026claudecode,
author = {Rostova, Elena},
title = {Claude Code Token Compromise & Hook Hijacking: Auditing CVE-2026-21852},
howpublished = {\url{https://eyestech.in/claude-code-token-compromise-hook-security-audit/}},
journal = {EyesTech Systems Research},
year = {2026},
note = {EyesTech Systems Lab Security Series}
}
MIT License. Maintained by EyesTech Systems Lab.