Brief · Builders
Your session ID was a command line.
Anthropic published the advisory on the SDK's GitHub repo Sep 12; CVE-2026-96620 and the GitHub advisory database entry followed Oct 16. It's a Critical, CVSS 4.0 score 9.2, in the Claude Agent SDK for Python. Every version before 0.2.121 is affected.
The bug is old school. The SDK passed your resume value to the Claude CLI as its own argument "without validation, allowing a value beginning with - to be interpreted as a separate CLI flag." Anthropic's advisory says an attacker could inject --mcp-config defining a stdio MCP server, "resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls."
The catch is in the same advisory: "Exploitation required an application to pass untrusted input as the session ID to resume." So the SDK left the door unlocked, but your app has to hand a stranger the handle.
Why it works: the CLI treats --resume as taking an optional value. Per the fix PR, with that kind of option, a next token that starts with a dash gets parsed as a separate flag, not as the value. The fix sends --resume=<value> as a single token instead, so the CLI rejects a dash-leading value as an invalid session ID. --session-id got the same treatment.
The fix isn't new, either. v0.2.121 shipped Jul 16 (ET). If you're on 0.2.121 or later (anything released since Jul 16), you're fine. If you pin and forget, the fix has been sitting there for three months, and the advisory for five weeks.
My take: "resume my session" endpoints that take the ID straight from a request or a URL are exactly the kind of thing people wire up in an afternoon. The PR describes that same pattern as the risky one.
What to do:
- Upgrade claude-agent-sdk to 0.2.121 or later.
- Never let the client pick the session ID. Map a user's session to an ID on the server, or check it against the IDs you issued. A value starting with - is not a session ID.
- Treat everything you pass to a CLI as untrusted. Bind values to their flags (--flag=value), validate the format, and use argv lists, never shell strings.
- Keep the agent in a box anyway. If someone does get commands to run at startup, a sandbox and default-deny egress limit what they can do with them.