Assistentes de Programação com IA Permitem que Qualquer Usuário Sequestre Estações de Trabalho Windows via C:\ProgramData

A newly disclosed Windows flaw (CVE-2026-35603) lets any non-admin user drop a malicious configuration file into the shared C:\ProgramData folder, where several AI-powered coding assistants automatically read settings. When an administrator later runs one of those tools—Claude Code, Cursor, Codex CLI or Gemini CLI—the malicious file is executed with full system privileges, giving the attacker control of the machine without any warning.

Why the problem matters

AI coding assistants have become common in development pipelines, often run with elevated rights to access compilers, package managers or internal repositories. The ability to inject code that runs as an administrator bypasses the usual user-level sandbox that protects a workstation. In practice, a low-privilege account could plant a file, wait for an admin to launch the assistant, and then have the assistant execute arbitrary commands, alter system files or harvest credentials. The impact ranges from a silent foothold for persistent malware to a full-blown takeover of corporate workstations.

How the vulnerability works

All four tools share a simple design choice: they store machine-wide configuration in C:\ProgramData and load those files automatically at start-up. On Windows that directory is readable and writable by any standard user. The tools do not verify the owner or integrity of the files before parsing them.

Tool	Expected config file
Claude Code	managed-settings.json
Cursor	hooks.json
Codex CLI	config.toml
Gemini CLI	system-defaults.json

An attacker creates a file with the exact name the tool looks for, places it in the corresponding folder under C:\ProgramData, and waits. When an administrator opens the assistant, the program reads the attacker-controlled file and executes its contents. In the case of Codex CLI, the malicious configuration can also turn off built-in security sandboxes, widening the attack surface further.

Anthropic, the maker of Claude Code, has already moved its settings to a protected location, effectively closing the gap for that product. The other vendors have not released a fix at the time of the research report, leaving their users exposed.

Who wins, who loses

• Attackers gain a straightforward privilege-escalation path that requires no exploit of kernel bugs or zero-day code.
• Developers and organizations that rely on these assistants for daily work face the risk of silent credential theft, code injection, or ransomware deployment.
• Tool vendors risk reputational damage and possible liability if the flaw is not patched promptly.

The cost of a breach can be high: compromised SSH keys, cloud tokens and Git credentials can open the door to broader network compromise. Even a single compromised workstation can become a launchpad for lateral movement inside a corporate environment.

Mitigation steps you can take today

Until the vendors ship patches, administrators can harden the folders themselves. The following PowerShell commands, run with elevated rights, create the expected directories (if they do not already exist) and lock them down so that only the system and administrators have write access:

# Create the directories
$paths = @(
    "C:\ProgramData\ClaudeCode",
    "C:\ProgramData\Cursor",
    "C:\ProgramData\openai\codex",
    "C:\ProgramData\gemini-cli"
)
foreach ($p in $paths) { New-Item -ItemType Directory -Path $p -Force }

# Remove inherited permissions and grant only the needed accounts
foreach ($p in $paths) {
    icacls $p /inheritance:r
    icacls $p /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
}

After applying the ACLs (access-control lists), scan the folders for any files owned by a standard user. Finding such a file is a strong indicator that the machine has already been compromised; in that case, rotate all private keys, cloud access tokens, and version-control credentials immediately.

What to watch for

• Vendor patches – Keep an eye on release notes from the affected vendors. A move to a protected location or an integrity check for configuration files would neutralize the issue.
• Security tooling updates – Endpoint detection platforms may add signatures for this specific pattern of file creation in C:\ProgramData. Deploying those updates can provide early alerts.
• Community disclosures – Security researchers may publish proof-of-concept exploits or detection scripts that can be incorporated into internal monitoring.

Counter-argument

Alguns podem argumentar que o risco se limita a máquinas onde existem múltiplas contas de usuário, ou que as ferramentas raramente são executadas com direitos de administrador. Embora esses fatores reduzam a superfície de ataque, eles não a eliminam. Muitos laptops corporativos são gerenciados centralmente e frequentemente concedem direitos de administrador a desenvolvedores para a instalação de compiladores ou SDKs. Além disso, malwares podem explorar a mesma pasta para persistir em um sistema mesmo sem um gatilho de nível de administrador, usando o assistente de IA apenas como um vetor de execução conveniente.

Conclusão

A CVE-2026-35603 demonstra como uma decisão de design aparentemente inócua — ler configurações de uma pasta com permissão de escrita para todos — pode se tornar um poderoso caminho de escalonamento quando ferramentas de IA estão envolvidas. Até que os fornecedores corrijam a falha, a única defesa confiável é restringir as subpastas C:\ProgramData usadas por esses assistentes e tratar qualquer arquivo inesperado ali como um sinal de comprometimento. Ignorar o problema deixa um caminho direto para que contas de baixo privilégio obtenham controle total de uma estação de trabalho Windows.