Claude Code's /copy command left responses in a world-readable temp file

What is this?

On June 25, 2026, an advisory (GHSA-4vp2-6q8c-pvq2) described a local security flaw in Claude Code, Anthropic’s command-line coding agent. The /copy command — which copies the assistant’s last response to the clipboard — first wrote that response to a fixed path on disk: /tmp/claude/response.md. The file was created world-readable (mode 0644) inside a world-traversable directory (0755), with no per-user isolation, no randomness in the name, and no protection against symlinks.

The consequence is a classic multi-user desktop problem, ported into an AI tool. On a shared host, any other local user could read that file — and a developer’s assistant response routinely contains secrets, API keys, tokens, or proprietary code pasted into the conversation. The bug was fixed in version 2.1.128, published in late June 2026, and affects every release from 2.1.59 up to that fix. It was reported by an external researcher through Anthropic’s coordinated disclosure program.

How it works

There is no novel exploit here, which is exactly the point. The failure is in two decades-old file-handling rules that the feature skipped.

Behaviour                     What /copy did             Why it is unsafe
----------------------------  -------------------------  -----------------------------
Path selection                Hardcoded /tmp/claude/     Predictable — any local user
                              response.md                knows where to look/plant
File permissions              0644 (world-readable)      Other users can read contents
Directory permissions         0755 (world-traversable)   Other users can enter and list
Symlink handling              none                       Follows an attacker's symlink
Per-UID isolation             none                       All users share one path

Two distinct risks fall out of this. The first is disclosure: because the file is world-readable, an unprivileged local user can simply read the last response of a privileged user who ran /copy. The second is a symlink write: because the path is static and predictable, a local user can pre-create the directory and plant a symlink at the expected filename pointing at some other file on disk. When the privileged process later writes the response, it follows the link and overwrites the attacker-chosen target with the response text. Both require a second, unprivileged user on the same machine and a privileged user actually invoking the command — so this is a local, multi-tenant issue, not a remote one. The weakness classes are the familiar CWE-377 (insecure temporary file), CWE-59 (link following) and CWE-200 (information exposure).

Why it matters

AI coding assistants are being adopted faster than their security track records can accumulate, and it is tempting to focus entirely on the exotic failure modes — prompt injection, tool-poisoning, sandbox escapes. This bug is a useful corrective: the mundane, pre-AI security primitives still apply, and a CLI that runs on developer laptops, CI runners, bastion hosts and shared build servers inherits every classic local-privilege footgun that ordinary Unix tools spent thirty years learning to avoid.

The blast radius is shaped by where the tool runs. On a single-user laptop the practical risk is low. On a shared build server, a multi-user jump host, or a container image where several service identities coexist, a world-readable file holding the plaintext of an assistant response is a credential-leak waiting to happen — and the symlink variant turns a read problem into a limited write primitive. It also composed poorly with the broader wave of Claude Code local-exposure findings this cycle, including an earlier issue where the Read tool reached the runner’s environment in CI. Temporary files that agents write are part of the attack surface, in the same way that symlink handling around approval flows has been.

Defenses

The primary fix is to upgrade; the rest is hygiene that generalizes to any AI CLI you run.

1. Update Claude Code to 2.1.128 or later. Auto-update users received it already; verify with claude --version and pin a floor in any managed installs.
2. Treat shared hosts as hostile for AI tools. Prefer per-user machines or per-UID sandboxes. On multi-user systems, avoid running assistant commands that materialize responses to disk unless you control the umask and the directory.
3. Harden temp handling at the OS layer. Enable fs.protected_symlinks=1 (default on modern Linux) so processes cannot follow symlinks into directories they do not own; use a per-user temp directory via XDG_RUNTIME_DIR or a private TMPDIR rather than a shared /tmp subtree.
4. For tool builders: create temp files the safe way. Use mkstemp-style APIs (randomized name, O_EXCL, mode 0600), write into a per-UID directory, and never a fixed shared path. Prefer streaming to the clipboard in memory over staging on disk at all.
5. Scan your dependency tree. This flaw is tracked in vulnerability databases against the @anthropic-ai/claude-code npm package; dependency-scanning and SCA tooling will now flag affected versions, so wire AI-CLI packages into the same pipeline as everything else.
6. Rotate anything that may have transited the file. If /copy ran on a shared machine while a vulnerable version was installed, treat secrets that appeared in those responses as potentially exposed and rotate them.

Status

Item	Reference	Date	Notes
Security advisory	GHSA-4vp2-6q8c-pvq2	2026-06-25	Insecure temp file + symlink write in /copy
CVE record	CVE-2026-46406 (NVD)	2026-06	CVSS 3.1 6.1 (medium); CWE-377, CWE-59, CWE-200
Affected versions	GitLab Advisory DB	—	2.1.59 up to, but not including, 2.1.128
Fixed version	Claude Code 2.1.128	2026-06-29	Auto-update deployed; manual updaters must upgrade

The lesson is not that AI coding tools are uniquely insecure — it is that they are software running on real machines, and the boring parts of software security did not stop applying when the tool learned to write code. Predictable temp paths, world-readable modes and unguarded symlinks are exactly the bugs a mature CLI should never ship, whatever it does with a language model underneath.