Backslash Security found more than 30 security-relevant patches to Anthropic’s Claude Code between April and early June 2026, a burst of fixes that researchers say exposes brief, often silent windows of vulnerability as models are updated at high cadence.
Backslash Security’s reconstruction of Claude Code’s update log
Researchers at Backslash Security reviewed update logs for every new version of a Claude Code release in the last two months and traced security-relevant fixes back to the version and date they shipped. The team identified details of more than 30 security-related patches implemented between April and early June 2026. Anthropic did not publicize those fixes; Backslash reconstructed them from changelogs and version history.
Yossi Pik, co‑founder and chief technology officer at Backslash Security, told CyberScoop that “the way AI agents are released is different than previous software.” He also said the team debated whether to publish the findings, noting colleagues responded, “Okay, every company has the [same] issue, then they patch and fix.”
Examples of the vulnerabilities patched in Claude Code
- The changelog details include fixes for data poisoning, prompt injection, and arbitrary code execution vulnerabilities.
- One patch closed a bypass that let a command designed to prevent catastrophic deletions—such as erasing an entire codebase—be undermined by adding a single backslash to the command.
- Another patch addressed a flaw that could leak user OAuth credentials.
- A third fix stopped an AI agent from planting a backdoor in shell startup files.
Release cadence: 16 Claude Code versions and the tradeoff for developers
Claude Code’s changelog indicates there were 16 different versions through the first half of June 2026; by comparison OpenAI’s Codex was updated six times in the same span. Backslash’s report argues that this ferocious pace of model updates creates a particular pressure: because updates can temporarily degrade performance or stability, many software developers delay upgrades for a week or more. Those time gaps, the report says, create small windows of vulnerability and force a tradeoff between security and performance.
Backslash’s researchers identified multiple reasons organizations do not immediately adopt new model versions: internal vetting or release schedules, regulated or air‑gapped environments where versions are frozen, the need to maintain long‑running sessions, and manual installations. “You don’t have that much flexibility,” Pik told CyberScoop. “Either I go to the latest and I’m getting a less stable version [of the model’ or I’m waiting for a few days or week until I can install it, and hope that nothing would happen during this time.”
Anthropic’s patching practices and documentation
The Backslash report did not frame its findings as a critique of Anthropic’s security rigor. Instead, it notes that Anthropic tends to “patch fast and document more than anyone” and that the company has addressed every issue and vulnerability identified in the report. For most Claude Code users, the auto‑update process would move them to the newest, secure version automatically; the report highlights, however, that many organizations do not or cannot rely on that automatic flow.
What this means for technologists and security teams, procurement and IT, and adversaries
- Technologists and security teams — They will need to manage the new operational reality that model updates are frequent and can introduce short‑lived regressions. The report shows teams must weigh auto‑updating against internal vetting, frozen versions in regulated or air‑gapped environments, and the risk that long‑running sessions remain tied to older, vulnerable model builds.
- Procurement and enterprise IT — Buyers who freeze model versions for compliance or stability should plan for staggered, tested update rollouts and clear escalation paths for critical patches; the Backslash account identifies manual installations and release schedules as common constraints that create exposure.
- Adversaries and threat actors — The vulnerabilities described—prompt injection, data poisoning, credential leakage, and backdoor planting—are specific to large language models and AI systems, indicating potential new avenues for attackers to influence models or extract sensitive data during windows before patches are applied.
Backslash Security’s audit of Claude Code’s changelogs makes a narrow but pointed case: rapid, frequent model updates can create many small and often silent security exposures, even when vendors patch quickly afterward. As one voice in the report put it, “It should not be compared to [Microsoft] Office that is installed and gets patched once in a while,” Yik points out. “It’s a completely different beast that keeps evolving, and we don’t want to limit it… I think that it’s great for everyone. We just need to make sure that we do it in a secure way, and every organization should understand what that means for them.”
Original story: https://cyberscoop.com/claude-code-security-vulnerabilities-ai-patches-backslash-security/
