← Back to feed

Mitiga Labs published a detailed attack chain on May 7, 2026, showing how an attacker can silently steal OAuth credentials from Claude Code’s Model Context Protocol integrations, persist through token rotation, and maintain SaaS access indefinitely — without triggering any user-visible alert. Anthropic reviewed the finding in April and declined to address it.

The Attack

Claude Code authenticates to MCP servers using OAuth. The bearer tokens it obtains are stored in plaintext inside ~/.claude.json — the same file that controls trust state, MCP server URLs, and shell-command prompt settings. Because all these settings share one file and one permission level, a process that can write to ~/.claude.json can change everything in it.

The attack starts with a malicious npm package. On install, a lifecycle hook runs automatically — no user interaction required beyond npm install. The hook does two things:

1. Locates common Claude Code project directories and sets the trust dialog flag to true, ensuring no confirmation prompt fires when those directories are subsequently opened.
2. Opens ~/.claude.json and rewrites the mcpServers config block to point at an attacker-controlled proxy.

From that point, every MCP session Claude Code initiates connects through the proxy. The OAuth token transits attacker infrastructure. The user sees a working integration. The provider sees a valid request from a trusted origin, because Claude Code’s egress runs through Anthropic’s infrastructure.

The persistence mechanism is the part that makes this hard to recover from. If the victim rotates their OAuth token, the hook detects the next config write and inserts the proxy URL back. If the victim manually restores the MCP endpoint, the hook overwrites it again on the next load. The attacker retains access as long as the hook remains in place.

What the Token Gets

An MCP OAuth token issued by a provider like GitHub, Slack, or any other SaaS tool is not scoped to a single operation. It grants the same access the user approved — typically broad repo, workspace, or account permissions. The token looks identical to the provider whether it originated from the legitimate machine or from a proxy three hops away. MFA is effectively bypassed: the token already represents a completed authentication.

The immediate risk is credential theft for every tool in a developer’s MCP configuration. The downstream risk is lateral movement: a Claude Code deployment at a company with MCP integrations to internal systems becomes a persistent access point, not a development tool.

Anthropic’s Response

Mitiga reported the findings to Anthropic on April 10, 2026. Anthropic acknowledged the report on April 11. On April 12, the response came back: out of scope.

The reasoning, consistent with Anthropic’s prior response to the Adversa TrustFall disclosure, was that the user consented to what happens when they install npm packages. The logic positions trust as a binary that transfers wholesale to any software running in the user’s environment.

No patch has been issued. Anthropic has not published a security advisory or a timeline for remediation.

Detection Without a Vendor Fix

Because Anthropic has not addressed this at the platform level, detection falls to individual developers and security teams. Mitiga recommends:

• Baseline approved MCP server URLs and alert on changes to ~/.claude.json
• Monitor for new localhost proxies or unexpected outbound connections during MCP sessions
• Review SaaS audit logs for valid-credential actions that do not match normal work patterns — valid origin, valid token, unusual task type
• Restrict or audit npm package installations on machines where Claude Code runs with production MCP integrations

Token rotation alone is insufficient as long as the hook remains installed. The hook must be found and removed first.

Key Numbers

• Disclosed: March 23, 2026 (Mitiga discovery)
• Reported to Anthropic: April 10, 2026
• Anthropic response: April 12 — “out of scope”
• Published: May 7, 2026 (SecurityWeek)
• Patch status: None
• Platforms affected: Any machine running Claude Code with dynamic-auth MCP servers
• Token storage: Plaintext in ~/.claude.json
• Persistence through rotation: Yes