← Back to feed
2026-04-15 Malicious ToolApt TLP:CLEAR

Claude Code Deny Rules Bypass via Subcommand Chaining: 50+ Command Pipeline Defeats Safety Controls

Date: 2026-04-15
Tags: malicious-tool, apt

Executive Summary

Adversa AI red team found Claude Code's deny rules silently stop working after 50 subcommands. Attackers can craft AI-generated command chains that exceed the safety threshold, causing Claude Code to fall back to unsafe 'ask' mode, circumventing user-configured denial rules designed to prevent data exfiltration.

Campaign Summary

FieldDetail
Campaign / MalwareClaude Code Safety Control Bypass
AttributionResearch Finding / Potential Threat Actors (confidence: medium)
TargetDevelopers using Claude Code in production and development environments
VectorCrafted CLAUDE.md files with 50+ subcommand pipelines triggering safety rule fallback
Statusactive
First Observed2026-04-13

Detailed Findings

Anthropic fixed a performance issue by capping analysis at 50 subcommands with a fall back to a generic 'ask' prompt, but Adversa discovered this process can be manipulated; this can be exploited via malicious CLAUDE.md files instructing the AI to generate 50+ subcommand pipelines that appear legitimate, bypassing deny rules. A vulnerability disclosed in April 2026 showed that Claude Code will ignore its deny rules if burdened with a sufficiently long chain of subcommands.

MITRE ATT&CK Mapping

TechniqueIDContext
Privilege EscalationT1548Bypassing deny rules via algorithmic limits in safety system
Exfiltration Over Command and Control ChannelT1071Using subcommand chains to exfiltrate data despite deny rules
Defense EvasionT1562Circumventing safety controls through engineered input structure

IOCs

Domains

_Vulnerability in Claude Code safety system; no malware or network IOCs_

Full URL Paths

_Vulnerability in Claude Code safety system; no malware or network IOCs_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

Claude Code (affected versions)

Detection Recommendations

Monitor Claude Code processes for command chains exceeding 45+ subcommands, audit CLAUDE.md configuration files for suspicious pipeline structures, enforce workspace isolation for Claude Code execution, implement honeypot deny rules that trigger alerting when bypassed, and maintain strict inventory of Claude Code deployments in production.

References