What changed
GitHub published advisory GHSA-h4mw-j7qp-8mwm on 16 October 2026 and marked it critical. The CVE identifier is CVE-2026-96620. The affected package is claude-agent-sdk on PyPI. Versions below 0.2.121 are vulnerable. The first patched version named in the advisory is 0.2.121.
The advisory says the Claude Agent SDK for Python passed the resume option to the Claude CLI without validation. A value that begins with a dash is then read as a separate CLI flag. An attacker who controlled that resume value could inject an --mcp-config flag that defines a stdio MCP server. The advisory says that produces arbitrary command execution at CLI startup and that it bypasses the SDK's permission controls.
The advisory also states the limit on that path. Exploitation required an application to pass untrusted input as the session ID used to resume. A caller that only forwards a session ID the same application created, and that never accepts that string from a user or from another service, is outside the case the advisory describes.
GitHub's thanks line names hackerone.com/moamenmahmood as the reporter. The advisory's instruction to users is to update to the latest version of the claude-agent-sdk package. The vulnerability record lists 0.2.121 as the first patched release.
Image: Anthropic
Why it matters
Resume is a convenience. An application stores a session ID and later asks the SDK to continue that session. The bug is that the SDK treated that string as CLI syntax, not as an opaque ID. Anything an attacker can place in that field, if the application treats outside input as a session ID, is parsed by the Claude CLI before the SDK's own permission checks apply. The advisory's example is an MCP config flag that starts a local stdio server, which is a command, at startup.
That is a different failure from a model that agrees to a bad prompt. The command runs because the process was started with an extra flag. Permission prompts inside the session do not get a vote on a process that already launched.
Teams that wrap the SDK in a product, and that let a customer, a webhook, or a stored record supply the resume value, are the ones the advisory points at. A desktop tool that only resumes sessions it minted itself is a narrower case, and the advisory says the exploit needs the untrusted session ID.
Who is affected
Python applications that depend on claude-agent-sdk below 0.2.121 and that pass a resume value into the SDK. Platform teams who embed the SDK in an internal agent and accept a session identifier from a queue, a database row a user can edit, or a request parameter. Security reviewers who inventory MCP servers their agents start, and who have not yet treated the resume field as a command line.
What to do next
Install claude-agent-sdk 0.2.121 or a newer release, and pin it. Search call sites for the resume argument. If any of them copy a string that did not originate inside the same process, stop passing that string until the pin is deployed. After the update, confirm a resume value that starts with a dash is rejected or treated as data, using a session ID you control in a test environment. Do not point a test at a production MCP config.
What to watch
Whether Anthropic or GitHub updates the advisory past the 16 October text, and whether a later note adds a CVSS vector or names other packages. The record as published is the Python package only. Also watch for applications that vendored an older SDK inside a container image that does not rebuild on a lockfile change.
Image: Anthropic
Sources
Primary — GitHub Security Advisory, GHSA-h4mw-j7qp-8mwm (16 October 2026). Establishes the resume flag injection, the requirement that the session ID be untrusted input, the package name, and the patched version 0.2.121.
Secondary — Anthropic, Claude Agent SDK research example (cookbook tree). Establishes that Anthropic publishes Agent SDK examples. It does not describe the vulnerability.
Related in Cyber Security
Continue reading