Anthropic

An attacker or compromised administrator may delete organization-level IP restrictions in Anthropic to disable network-based access controls and enable the use of administrative credentials from unauthorized locations.

Unauthorized deletion of Anthropic admin API keys may indicate an attacker disrupting security monitoring, disabling compliance logging, or covering tracks after establishing persistence.

This detection monitors for potential credential brute force or stuffing activity against Anthropic accounts by identifying multiple authentication failures for a single email address within one hour.

CVE-2026-35022 describes an OS command injection vulnerability in the Anthropic Claude Code CLI and Claude Agent SDK that allows attackers with control over authentication settings to execute arbitrary commands, potentially leading to credential theft and environment variable exfiltration.

The Anthropic Claude Code CLI and Claude Agent SDK are vulnerable to OS command injection via crafted file paths, allowing arbitrary command execution.