Claude Agent SDK Argument Injection CVE-2026-96620 Lets a Crafted Resume Session Id Run Commands
Date: 2026-10-18
Tags: mcp-security
Executive Summary
An argument injection in Anthropic's Python Claude Agent SDK, tracked as CVE-2026-96620, let a resume session id starting with a dash become a CLI flag, which allowed an attacker to define an MCP server that runs commands. The flaw was rated high and is fixed in claude-agent-sdk 0.2.121. Applications that resume sessions from user supplied values should treat the session id as an opaque token they issued and reject anything that starts with a dash.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | CVE-2026-96620 Claude Agent SDK argument injection |
| Attribution | Unknown (confidence: none) |
| Target | Applications using the Anthropic Python Claude Agent SDK that resume user supplied session ids |
| Vector | Argument injection through a resume session id that begins with a dash |
| Status | disrupted |
| First Observed | 2026-10-16 |
Detailed Findings
According to theinjection.dev, CVE-2026-96620 covers an argument injection in Anthropic's Claude Agent SDK for Python in which a resume session id starting with a dash became a CLI flag, letting an attacker define an MCP server that runs commands. The same report rated the issue high and stated it was fixed in claude-agent-sdk 0.2.121. The guidance in that report advises that where an application resumes sessions from values a user supplies, the session id should be treated as an opaque token the application issued and anything starting with a dash should be rejected.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Command and Scripting Interpreter | T1059 | The injected resume session id became a CLI flag that let the attacker define an MCP server which executes commands. |
IOCs
Domains
_No IOCs published. Affected component is a legitimate library, so the version note is recorded here rather than as a package IOC. Fixed in claude-agent-sdk 0.2.121._
Full URL Paths
_No IOCs published. Affected component is a legitimate library, so the version note is recorded here rather than as a package IOC. Fixed in claude-agent-sdk 0.2.121._
Splunk Format
_No IOCs available for Splunk query_
Affected Platforms
Anthropic Claude Agent SDK for Python (claude-agent-sdk before 0.2.121)Detection Recommendations
Update claude-agent-sdk to 0.2.121 or later. Reject resume session ids that start with a dash and validate them as opaque tokens issued by the application. Monitor MCP server definitions and child process creation spawned by Claude Agent SDK applications for servers the user did not configure.
References
- [The Injection] AI security news, week 42 of 2026 (2026-10-18) — https://theinjection.dev/week/2026-w42/