Auditing Claude Code: Security Findings and Containment Strategies

What Claude Code captures from your system (and how to contain it)

Engineer Cepunkt conducted a systematic audit of Claude Code in early 2026 after observing unexpected shell environment behavior. The audit found that the tool automatically bundles and transmits local SSH configs, aliases, and environment variables at startup.

Why This Matters

The audit reveals a disconnect between documented security controls and the actual execution paths of AI coding binaries. When environment variables like CLAUDE_CODE_DONT_INHERIT_ENV exist but fail to function in the execution path, it creates a false sense of security while sensitive internal infrastructure data is exfiltrated to telemetry providers like Statsig and GrowthBook.

Key Insights

• Shell Snapshot Exfiltration: Claude Code captures aliases, internal hostnames, and SSH configs with jump hosts at startup (Finding 001, 2026).
• AI-Classified Behavioral Profiling: Sessions are analyzed to infer user intent and satisfaction levels, with initial prompts captured verbatim (Cepunkt Audit, 2026).
• Broken Security Controls: The CLAUDE_CODE_DONT_INHERIT_ENV variable is decorative and does not prevent environment inheritance in the execution path.
• Telemetry Infrastructure: The tool integrates Statsig, Sentry, and GrowthBook for data exfiltration via Anthropic beacon endpoints.
• Deobfuscation via AI: The audit utilized the Claude model itself to deobfuscate the Claude Code binary and identify containment strategies.

Practical Applications

• Host Containment: Run Claude Code inside a Docker container with a minimal user environment to ensure the shell capture only sees the container’s empty environment.
• Network-Level Mitigation: Block telemetry domains including Statsig and GrowthBook via /etc/hosts to reduce data exposure to external endpoints.

References:

• https://dev.to/cepunkt_1d9c6e96d0ed47998/auditing-claude-code-what-i-found-and-how-i-contained-it-5djo
• https://github.com/cepunkt/ccaudit-public