On October 16, CVE-2026-96620 was published: a critical flaw (CVSS v4.0 score of 9.2) in the Claude Agent SDK for Python, where an option meant for resuming sessions could become a path to run commands outside the SDK's permission controls.
How the Vulnerability Works
According to the OSV record (advisory GHSA-h4mw-j7qp-8mwm), before version 0.2.121 the SDK passed the resume option to the Claude CLI as a separate argument, without validating it. If the value starts with a hyphen, the CLI parses it as a standalone flag. An attacker can inject --mcp-config to define a stdio-type MCP server, which runs arbitrary commands when the CLI starts, and that happens outside the SDK's permission controls.
This is a classic argument injection (CWE-88), alongside CWE-20 and CWE-78. What makes it interesting for agents: the attacker doesn't need to trick the model with a prompt. It's enough for the application to forward a session identifier from the outside world to the SDK.
Who Is Affected and What the Fix Is
The key condition is that the application passes untrusted input as the session ID to resume. An internal script that only resumes sessions it created itself isn't exposed through this path; a web service that accepts the session ID from a URL parameter, a JSON body or an external client is.
What Is Known (and Not Known) About Exploitation
According to the databases consulted, as of October 21 SecurityOnline reported no confirmed exploitation and no public exploit was found; the vulnerability wasn't listed in CISA's KEV catalog and its EPSS was around 0.58%. These are third-party data points that can change: check the current status before deciding how urgent this is.
What This Means for a Company Building Agents
1. Upgrade to 0.2.121 or later in any service that uses the Python SDK. Check with pip show claude-agent-sdk and in your lockfile.
2. Never pass external input straight into SDK options. Validate session IDs against an expected format (a UUID, for example) or against a table of your own sessions, and reject any value that starts with -.
3. Treat MCP configuration as a code-execution surface. A stdio MCP server is a system command; limit which processes the service user can launch and run the agent with least privilege.
4. Inventory your agents. This flaw fits a pattern that keeps repeating in 2026: agents fail less because of the model and more because of the glue code that feeds them parameters.
Sources: OSV CVE-2026-96620 (modified Oct 22, 2026) and vulnerability aggregators (OpenCVE, Vulert, SecurityOnline) for exploitation status.