Overview
Claude Code is anthropic’s terminal-based AI coding agent with filesystem and shell access. Core product in the coding-agents category alongside github-copilot, cursor, and codex.
Capabilities
- File read/write, shell command execution, git operations
- Supports claude-sonnet-5 and claude-opus-4-8 model backends
- Custom API routing via
ANTHROPIC_BASE_URLenvironment variable - Official plugins marketplace including claude-security-plugin (beta)
Claude Security Plugin (July 2026)
- 2026-07-22/23: claude-security-plugin public beta —
/plugin install claude-security@claude-plugins-official; requires ≥v2.1.154 + dynamic workflows (2026-07-24-anthropic-claude-security-docs) - Multi-agent scan (full repo or diffs); patches suggested only; never auto-applied
- Distinct from hosted claude-security Enterprise
In-App Browser (July 2026)
- 2026-07-10: Sandboxed in-app browser on Claude Code desktop — read, navigate, interact with docs, designs, external sites (2026-07-11-anthropic-claude-code-browser-9to5mac)
- Launch: Cmd+Shift+B (macOS) / Ctrl+Shift+B (Windows)
- Isolated browser profile — no personal logins or history; configurable session persistence
- Safety classifiers review actions on external sites; user approval for write actions
- Distinct from Claude in Chrome extension (shares login state for authenticated sessions)
- Competitive context: parallels openai ChatGPT desktop built-in browser; Atlas sunset
Enterprise Policy Impact (July 2026)
- 2026-07-08: China’s nvdb issued government security alert on versions 2.1.91–2.1.196 — “backdoor” characterization (2026-07-08-china-nvdb-claude-code-security-backdoor)
- alibaba workplace ban effective July 10, 2026 — employees directed to qoder
- Escalation from employer policy to national CVE-style advisory
Permission Model (July 2026)
- v2.1.200 (July 3): Default mode renamed to Manual — explicit approval per file write, shell, network call (2026-07-08-claude-code-manual-approval-default)
- Auto mode (Sonnet 4.6 classifier) now opt-in; 93% blind-approval telemetry cited
- Config value remains
default;manualaccepted as alias - See permission-model
Scientific Research (July 2026)
- giorgio-parisi used Claude (Opus 4.7) to prove decade-old jamming conjecture a+b=1 — peer-reviewed in JSTAT (2026-07-01-parisi-claude-jamming-arxiv)
Trust & Security Incidents (2026)
China Proxy Steganography (June–July 2026)
- v2.1.91+ (April 2, 2026): Covert fingerprinting when
ANTHROPIC_BASE_URL≠api.anthropic.com - Encoded proxy/timezone signals in “Today’s date is” system prompt via Unicode apostrophe variants and date separators
- XOR-obfuscated domain lists (147 China-linked entries, 11 AI-lab keywords)
- v2.1.197 (July 1, 2026): Rollback merged; changelog did not explicitly confirm removal (2026-07-01-claude-code-surveillance-techtimes)
Anthropic stated anti-distillation rationale (unauthorized resellers, Chinese lab campaigns) but bypass is trivial; legitimate proxy users affected ( 2026-07-01-claude-code-surveillance-vincentschmalbach).
Prior Undisclosed Issues
- Sandbox SOCKS5 null-byte bypass (~130 releases, Oct 2025–Apr 2026) — fixed without CVE (2026-07-01-claude-code-surveillance-techtimes)
- mozilla-0din demonstrated malware delivery via clean-repo agent attack (2026-06-27-mozilla-0din-claude-code-github-malware)
Developer Culture
- Engineering lead Fiona Fung reported agent-heavy workflows increase isolation; team uses pair-programming mitigations (2026-06-25-anthropic-claude-code-developer-isolation)