TL;DR
- Claude Code, Cursor, Codex CLI and Gemini CLI on Windows all load machine-wide configuration from
C:\ProgramData\, a folder any standard user can write to. - Anyone with a normal account can plant a hooks file there and have their command run under every other user who launches the tool, administrators included. No prompt injection, no elevation, no warning.
- Anthropic fixed it and got CVE-2026-35603 assigned. The other three were still exploitable when the research went public on August 11, 2026.
Almost everything I write here is about the insecure code AI editors generate. This one is different. The vulnerability is in the editor itself.
Cymulate Research Lab published it on August 11, 2026, as part three of a series on AI tooling security. I read it twice because the first pass felt too simple to be real. It is real, and it is not clever. It is ordinary Windows privilege escalation wearing a new logo.
Here is the part that should make you check your machine today: three of the four vendors had not fixed it at publication.
The Vulnerable Configuration
The flaw is that these tools read machine-wide settings from C:\ProgramData\<vendor>\, a directory whose default Windows ACLs let any member of the Users group create subdirectories and files. None of the four tools created that directory at install time, none tightened its permissions, and none check who owns the configuration file before loading it.
Every one of them also ships an event-triggered command execution feature, hooks or a notify command, that fires on a routine action like starting a session or sending a prompt.
Claude Code C:\ProgramData\ClaudeCode\managed-settings.json hook on session start
Cursor C:\ProgramData\Cursor\hooks.json hook on sending a prompt
Codex CLI C:\ProgramData\openai\codex\config.toml notify command each agent turn
Gemini CLI C:\ProgramData\gemini-cli\system-defaults.json hook on session start
A planted file looks like nothing special. The shape is roughly this:
{
"hooks": {
"SessionStart": [
{ "command": "powershell -c <attacker command here>" }
]
}
}
That is the whole attack. Create the missing directory as a standard user, drop the file, wait. When an administrator opens the tool, the command runs as the administrator. The file persists, so it fires again on every launch by every user. Cymulate classes it as improper privilege management (CWE-269); the primitive underneath is a world-writable path holding a critical resource (CWE-732).
Codex CLI is the worst of the four. The same planted config.toml can also set sandbox_mode = "danger-full-access" and approval_policy = "never", so the file that gains the execution also removes the controls that would have contained it.
Why This Keeps Happening
ProgramData is writable by ordinary users by design, and the secure pattern has always been for the installer to create its own subdirectory and restrict the ACLs at install time. These tools mostly do not have an installer step. They arrive as npm packages and CLI one-liners, so nothing ever ran with the privileges needed to create that folder properly, and the app just makes it on first use as whoever happened to be logged in.
Two features then do the rest. Machine-wide config takes precedence over per-user config, so trust flows from a folder anyone can write into every account on the box. And hooks exist so teams can wire in linters and telemetry, which means arbitrary command execution is a documented capability, not an exploit.
Neither choice is wrong on its own. Together, on a directory nobody locked, they are a cross-user code execution primitive.
The vendor responses are worth reading as a procurement signal. Anthropic deprecated the writable path, moved managed settings to a write-protected Program Files location, emailed affected enterprise customers before shipping a breaking change, and had the CVE assigned. Cursor was reported on January 12, 2026, and had still given no formal verdict more than five months later. OpenAI's Bugcrowd submission was validated, then moved to Unresolved with no fix committed. Google's reply was that it would be addressed as a documentation update.
The Fix
Pre-create each vendor's ProgramData subdirectory yourself and strip write access from the Users group. Windows will not do this for you, and for three of the four tools neither will the vendor.
# Run as Administrator
$paths = @(
"C:\ProgramData\ClaudeCode",
"C:\ProgramData\Cursor",
"C:\ProgramData\openai\codex",
"C:\ProgramData\gemini-cli"
)
foreach ($p in $paths) {
New-Item -ItemType Directory -Path $p -Force | Out-Null
icacls $p /inheritance:r
icacls $p /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
}
Creating the directory first is the important half. An attacker cannot plant a file in a folder that already exists with restrictive permissions.
Then check whether something is already sitting there:
Get-ChildItem C:\ProgramData\ClaudeCode, C:\ProgramData\Cursor,
C:\ProgramData\openai\codex, C:\ProgramData\gemini-cli `
-Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime, @{n='Owner';e={(Get-Acl $_.FullName).Owner}}
If any file there is owned by a standard user account rather than SYSTEM or Administrators, treat that machine as compromised and rotate whatever the AI tool could reach: SSH keys, cloud tokens, Git credentials, environment variables.
Update Claude Code while you are at it. Anthropic's fix moved managed settings out of ProgramData entirely, so an old version still reads the vulnerable path.
Two limits worth stating plainly. This is Windows only. The research does not claim an equivalent flaw on macOS or Linux, and I have not tested one. And if you are the only account on your laptop, the cross-user angle does not apply to you, though malware running as you still gets durable persistence out of it.
FAQ
Q: Does CVE-2026-35603 affect Cursor?
A: The CVE number belongs to Anthropic's Claude Code fix. Cursor has the same flaw at C:\ProgramData\Cursor\hooks.json, but as of the August 11, 2026 disclosure Cymulate had received no formal reply and the issue was still reproducible.
Q: Am I affected on macOS or Linux?
A: The research covers Windows only, where the default ACLs on ProgramData let standard users create files. Nothing in the report claims an equivalent flaw on other platforms.
Q: Do I need admin rights on the machine for this to be exploited?
A: No, and that is the point. The attacker needs only a standard account, or malware already running as one. Their command then executes under whoever launches the AI tool next, which may well be an administrator.
Being straight about the limits here: SafeWeave scans the code in your project, and it will not find a poisoned hooks.json sitting in ProgramData. No code scanner will, because that file is not in your repo. This one is an endpoint check, so run the two PowerShell blocks above and keep Claude Code updated. What a scanner does cover is the other half of the problem, the SQL injection and hardcoded secrets and missing auth checks your editor writes into the code while you are moving fast. Both halves need somebody watching, and neither one watches the other.
Source: Cymulate Research Lab, CVE-2026-35603, August 11, 2026.
