On October 16, 2026, GitHub published advisory GHSA-h4mw-j7qp-8mwm, CVE-2026-96620, for Anthropic’s Claude Agent SDK for Python, the library developers use to build their own agents on top of the Claude Code command-line tool. It is rated critical, 9.2 under CVSS 4.0.
The SDK passed its resume option, the ID of a previous session to continue, straight through to the Claude CLI without validation. A value beginning with a dash was therefore read as a separate command-line flag. An attacker who controlled that value could inject an —mcp-config flag defining a stdio MCP server, and because a stdio MCP server is just a command the CLI launches, that meant arbitrary command execution at CLI startup, before and outside the SDK’s permission controls. Every version before 0.2.121 is affected; the fix is in 0.2.121. Anthropic credits a HackerOne researcher, moamenmahmood.
Why it matters: it is a textbook argument-injection bug, but the payload is distinctly agentic. The Model Context Protocol’s stdio transport turns “add a tool server” into “run this program”, so any path that lets untrusted text reach an MCP configuration is a path to code execution. The same pattern has now surfaced in Langflow, Kiro and others; here it reached the official SDK of a major model vendor.
What it does not show: exploitation needs an application that passes untrusted input as the session ID to resume, which most integrations would not do, and no exploitation in the wild has been reported.