Claude Code’s 30-plus patches expose AI agent update gap
For regulated teams, the risk is the week between a quiet fix and the next version they are allowed to run.
TL;DR
CyberScoop reports that Backslash Security reviewed Claude Code update logs and traced more than 30 security-relevant patches between April and early June 2026, including data poisoning, prompt injection, arbitrary code execution, OAuth leakage and a backslash bypass for destructive commands. Anthropic patched the issues, but did not separately publicize them. Teams that freeze AI coding-agent versions for vetting, air-gapped use or stability inherit the gap that auto-update users largely avoid.
Backslash’s finding is narrower than the usual AI alarm. CyberScoop says Anthropic patched every issue Backslash identified and that auto-update users would be moved to a secure build. The change-control problem is the part that matters: Backslash found more than 30 security-relevant fixes in update logs from April to early June 2026, including data poisoning, prompt injection, arbitrary code execution, leaked OAuth credentials, a destructive-command bypass triggered by one backslash, and a shell-startup-file backdoor path.
That matters because coding agents are being inserted into development workflows where version changes are deliberately slow. The report cites teams that wait a week or more before upgrading, freeze versions in regulated or air-gapped environments, keep long-running sessions alive, or require internal vetting before installation. Those are normal controls for ordinary software. With fast-moving AI agents, they can also preserve a vulnerable version long after the vendor has already fixed the flaw.
For federal contractors, the compliance question is whether procurement, system security plans and secure development procedures know which AI agent version is allowed to touch code, who approves updates, and how security-relevant release notes get escalated. CISA’s software supply chain guidance treats patches and hotfixes as part of the supply chain and points customers and vendors to NIST C-SCRM and the Secure Software Development Framework for risk mitigation (CISA).
The Monday work is tedious and real: pin versions, record exception paths for urgent security updates, decide when auto-update is acceptable, and require vendors to surface security fixes outside generic changelogs. If the only people who know an AI agent update closed an arbitrary-code-execution path are researchers scraping logs, the organization’s risk process is decorative.
Published ·Deep Fathom