CPE
The Claude Agent SDK for Python fails to validate the resume option, enabling an argument injection attack that allows arbitrary command execution via unauthorized MCP server configurations.