GoPlus Security 🚦 (@GoPlusSecurity): 🛡️ From 512K Lines of Leaked Code: How Claude Code Achieves “Security First”

🛡️ From 512K Lines of Leaked Code: How Claude Code Achieves “Security First” I. Design Philosophy & Security Architecture Overview Claude Code places “Security First” at the core of its design philosophy. This has been a defining characteristic since its inception, and a key factor that clearly differentiates it from OpenAI. It is also one of the main drivers behind Claude Code’s rapid growth in the enterprise market in recent years. As an AI Agent capable of executing local code, reading and writing to the file system, initiating network requests, and even running high-risk terminal commands, it faces a threat surface far beyond traditional web applications or simple conversational LLMs. These risks include code execution escape, path traversal, credential exfiltration, and prompt injection. To address these challenges, Claude Code does not rely solely on regex-based allowlists or denylists. Instead, it builds a multi-layered, defense-in-depth architecture, spanning from the system kernel layer (OS Namespace) to the application layer (AST analysis and AI classifiers), where each layer reinforces and backs up the others. This system not only ensures strong protection of local assets, but also maintains a high level of developer experience and flexibility. II. Technical Analysis of the Defense-in-Depth System 1. Permission Layering & Learning-based Fail-Open (Permission System) Function Description: Claude Code’s permission system is not a binary “allow / deny” model. Instead, it is designed with three states: allow, deny, and ask (pause and request user confirmation). With Auto Mode enabled, the system uses an AI classifier to dynamically evaluate and approve ask-level requests. When the classifier becomes unavailable due to model degradation or network interruption, the system adopts a “learning-based fallback strategy” combined with a Fail-Open design, smoothly degrading into standard human-in-the-loop authorization via pop-up confirmation, rather than causing the entire toolchain to break. Code Implementation: types/permissions.ts utils/permissions/permissions.ts Key Code Analysis: 2. Enterprise Hook Interception Chain & Deny Rules Function Description: In enterprise collaboration and internal security compliance scenarios, Claude Code provides a Hook interception chain (e.g. PreToolUse). It supports dynamically pulling enterprise policySettings from the backend and can enforce strict validation of enterprise-level Deny rules. For example, enterprises can configure allowManagedHooksOnly to force-disable unsafe developer-defined Hooks, and forward commands to internal security auditing services for interception before they are executed by the BashTool. Code Implementation: utils/hooks/hooksConfigSnapshot.ts services/tools/toolHooks.ts Key Code Analysis: 3. AI Classifiers for Prompt Injection Defense Function Description: As Prompt Injection and obfuscated privilege-escalation attacks become increasingly sophisticated, traditional static analysis is becoming easier to bypass. Claude Code introduces a two-stage XML Classifier / YOLO Classifier. When handling automated decisions, the AI evaluates the intent behind tool actions issued by the large model from a security perspective — such as whether they involve weakening system protections or attempting to disable Defender — effectively using “magic to defeat magic.” Code Implementation: utils/permissions/yoloClassifier.ts Key Code Analysis: 4. BashTool Sandbox: AST Analysis & Iterative Unpacking Function Description: Bash command execution is the highest-risk entry point. Claude Code builds an extremely strict filtering layer at the application level: 25 AST-based static checks: Using Tree-sitter to parse shell syntax, precisely defending against attacks such as JQ injection, carriage return (CR) injection, and comment/quote desynchronization. Fixed-Point Iterative Unpacking: Attackers often bypass prefix matching with patterns like FOO=bar nohup rm -rf /. The system uses a while loop to repeatedly strip environment variables and wrappers until the underlying real command is fully exposed, and only then performs permission checks. Code Implementation: tools/BashTool/bashSecurity.ts tools/BashTool/bashPermissions.ts Key Code Analysis: 5. OS-Level Sandbox Isolation (OS-Level Sandbox) Function Description: To prevent application-layer checks from being bypassed by 0-day vulnerabilities, Claude Code integrates a kernel-level isolation solution (@anthropic-ai/sandbox-runtime). On Linux/WSL2, it leverages bwrap to establish Mount/PID Namespaces; on macOS, it uses sandbox-exec. All subprocesses run within read-only or minimally privileged environments, forming the final physical line of defense against catastrophic damage caused by arbitrary code execution (RCE). Code Implementation: utils/sandbox/sandbox-adapter.ts Key Code Analysis: