A newly disclosed Windows flaw (CVE-2026-35603) lets any non-admin user drop a malicious configuration file into the shared C:\ProgramData folder, where several AI-powered coding assistants automatically read settings. When an administrator later runs one of those tools—Claude Code, Cursor, Codex CLI or Gemini CLI—the malicious file is executed with full system privileges, giving the attacker control of the machine without any warning.

Why the problem matters

AI coding assistants have become common in development pipelines, often run with elevated rights to access compilers, package managers or internal repositories. The ability to inject code that runs as an administrator bypasses the usual user-level sandbox that protects a workstation. In practice, a low-privilege account could plant a file, wait for an admin to launch the assistant, and then have the assistant execute arbitrary commands, alter system files or harvest credentials. The impact ranges from a silent foothold for persistent malware to a full-blown takeover of corporate workstations.

How the vulnerability works

All four tools share a simple design choice: they store machine-wide configuration in C:\ProgramData and load those files automatically at start-up. On Windows that directory is readable and writable by any standard user. The tools do not verify the owner or integrity of the files before parsing them.

Tool Expected config file
Claude Code managed-settings.json
Cursor hooks.json
Codex CLI config.toml
Gemini CLI system-defaults.json

An attacker creates a file with the exact name the tool looks for, places it in the corresponding folder under C:\ProgramData, and waits. When an administrator opens the assistant, the program reads the attacker-controlled file and executes its contents. In the case of Codex CLI, the malicious configuration can also turn off built-in security sandboxes, widening the attack surface further.

Anthropic, the maker of Claude Code, has already moved its settings to a protected location, effectively closing the gap for that product. The other vendors have not released a fix at the time of the research report, leaving their users exposed.

Who wins, who loses

  • Attackers gain a straightforward privilege-escalation path that requires no exploit of kernel bugs or zero-day code.
  • Developers and organizations that rely on these assistants for daily work face the risk of silent credential theft, code injection, or ransomware deployment.
  • Tool vendors risk reputational damage and possible liability if the flaw is not patched promptly.

The cost of a breach can be high: compromised SSH keys, cloud tokens and Git credentials can open the door to broader network compromise. Even a single compromised workstation can become a launchpad for lateral movement inside a corporate environment.

Mitigation steps you can take today

Until the vendors ship patches, administrators can harden the folders themselves. The following PowerShell commands, run with elevated rights, create the expected directories (if they do not already exist) and lock them down so that only the system and administrators have write access:

# Create the directories
$paths = @(
    "C:\ProgramData\ClaudeCode",
    "C:\ProgramData\Cursor",
    "C:\ProgramData\openai\codex",
    "C:\ProgramData\gemini-cli"
)
foreach ($p in $paths) { New-Item -ItemType Directory -Path $p -Force }

# Remove inherited permissions and grant only the needed accounts
foreach ($p in $paths) {
    icacls $p /inheritance:r
    icacls $p /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
}

After applying the ACLs (access-control lists), scan the folders for any files owned by a standard user. Finding such a file is a strong indicator that the machine has already been compromised; in that case, rotate all private keys, cloud access tokens, and version-control credentials immediately.

What to watch for

  • Vendor patches – Keep an eye on release notes from the affected vendors. A move to a protected location or an integrity check for configuration files would neutralize the issue.
  • Security tooling updates – Endpoint detection platforms may add signatures for this specific pattern of file creation in C:\ProgramData. Deploying those updates can provide early alerts.
  • Community disclosures – Security researchers may publish proof-of-concept exploits or detection scripts that can be incorporated into internal monitoring.

Counter-argument

برخی ممکن است استدلال کنند که این خطر محدود به سیستم‌هایی است که چندین حساب کاربری در آن‌ها وجود دارد، یا اینکه این ابزارها به‌ندرت با دسترسی مدیر (administrator) اجرا می‌شوند. اگرچه این عوامل سطح حمله را کاهش می‌دهند، اما آن را از بین نمی‌برند. بسیاری از لپ‌تاپ‌های شرکتی به‌صورت متمرکز مدیریت می‌شوند و اغلب برای نصب کامپایلرها یا SDKها، دسترسی‌های ادمین را به توسعه‌دهندگان اعطا می‌کنند. علاوه بر این، بدافزارها می‌توانند از همان پوشه برای ماندگاری در سیستم استفاده کنند، حتی بدون نیاز به یک محرک در سطح مدیریت؛ در این حالت، دستیار هوش مصنوعی صرفاً به عنوان یک بردار اجرای (execution vector) راحت مورد استفاده قرار می‌گیرد.

نکته کلیدی

CVE-2026-35603 نشان می‌دهد که چگونه یک تصمیم طراحی به‌ظاهر بی‌ضرر — یعنی خواندن تنظیمات از یک پوشه world-writable (قابل نوشتن توسط همه) — می‌تواند در صورت درگیر شدن ابزارهای هوش مصنوعی، به یک مسیر ارتقاء سطح دسترسی قدرتمند تبدیل شود. تا زمانی که سازندگان این نقص را برطرف نکنند، تنها دفاع قابل اعتماد، محدود کردن زیرپوشه‌های C:\ProgramData مورد استفاده توسط این دستیارها و در نظر گرفتن هرگونه فایل غیرمنتظره در آنجا به عنوان نشانه‌ای از نفوذ است. نادیده گرفتن این مسئله، مسیری مستقیم را برای حساب‌های با سطح دسترسی پایین باقی می‌گذارد تا کنترل کامل یک ایستگاه کاری ویندوز را به دست بگیرند.