Key points
- The vulnerability affects all versions of the Claude Agent SDK for Python prior to 0.2.121.
- Attackers can inject CLI flags by passing dash-leading values as session IDs to the resume option.
- A fix is available in version 0.2.121, which validates input to prevent flag interpretation.
Anthropic has released version 0.2.121 of the Claude Agent SDK for Python to address a critical security flaw. The update fixes CVE-2026-96620, which allows attackers to execute arbitrary commands on systems running the SDK. Security teams should verify their installations immediately and apply the patch to any environment using versions older than 0.2.121.
In plain English
The bug occurs because the SDK passes the `resume` option to the underlying Claude CLI without checking its content. If an attacker controls the session ID passed to this option, they can supply a value starting with a dash. The CLI interprets this dash as the start of a command-line flag rather than data. This allows the injection of malicious flags like `--mcp-config`, which defines a server that runs commands at startup, bypassing the SDK's built-in permission controls.
The background
The Claude Agent SDK is a Python library designed to help developers build agents using Claude Code. According to the National Vulnerability Database, the flaw stems from improper input validation, categorized under CWE-20, CWE-78, and CWE-88. The issue was reported by researcher Moamen Mahmood via HackerOne. This incident follows other recent SDK vulnerabilities, such as the GitPython argument injection flaw Vuln Post covered in October 2026, highlighting the ongoing risks in rapidly evolving developer tools.
What changes now
Version 0.2.121 introduces validation for the `resume` parameter to prevent it from being parsed as a separate CLI token. This blocks the injection of flags like `--mcp-config` that previously allowed arbitrary command execution. Users are advised to update their pip installations to this patched version immediately. The fix ensures that session IDs are treated strictly as data, maintaining the integrity of the SDK's permission model during CLI startup.
Who needs to act first
Teams should prioritize updating systems that accept external or user-generated input for session management. Check whether any application logic passes untrusted data into the SDK's resume function. Roll out the fix in test environments first to ensure compatibility with existing agent workflows. Back up configuration files before updating. If immediate patching is impossible, restrict the resume feature to trusted internal sessions only. Monitor logs for unexpected CLI flag usage patterns that might indicate exploitation attempts.
Background: Input validation
Input validation cyber security requires checking every piece of data entering a system for type, length, and format. You must reject unexpected data immediately. This prevents attackers from injecting malicious code or causing system crashes. Trusting user input without strict rules allows breaches to occur.
Read the full guide: Input Validation Cyber Security: Stop Code Injection Before It Starts
What to do and how to stay safe: Anthropic
- Audit your Python dependencies to identify any installations of claude-agent-sdk versions older than 0.2.121.
- Review application code to ensure no untrusted user input is passed directly to the resume parameter.
- Update to version 0.2.121 or later as soon as possible to mitigate the risk of command injection.
- Monitor system logs for unusual CLI startup behaviors or unexpected process executions following resume calls.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Claude Agent SDK are vulnerable to CVE-2026-96620?
All versions of the Claude Agent SDK for Python prior to 0.2.121 are affected by this critical vulnerability.
How can an attacker exploit this flaw?
An attacker can exploit this by controlling the resume value and passing a dash-leading string that the CLI interprets as a flag, such as --mcp-config.
Is there a fix available for this issue?
Yes, the issue is fixed in version 0.2.121 of the claude-agent-sdk package, which validates the resume option input.
