CVE-2026-35603: World-Writable Windows Config Hits AI CLIs

Four widely used AI coding CLIs on Windows load machine-wide config from a folder any standard user can write to, then run commands from it automatically.

Cymulate Research Lab published the finding on August 11, 2026, as part three of a series on AI tooling security, according to a Dev.to write-up of the research. Anthropic fixed the issue in Claude Code and was assigned CVE-2026-35603. The write-up states the other three were still exploitable when the research went public.

The flaw

All four tools read machine-wide settings from C:\ProgramData\, a directory whose default Windows ACLs let any member of the Users group create subdirectories and files. Per the write-up, none of the four created that directory at install time, none tightened its permissions, and none check who owns the configuration file before loading it.

That would be a low-severity gap on its own. What makes it exploitable is that every one of them also ships an event-triggered command execution feature — hooks, or a notify command — that fires on a routine action like starting a session or sending a prompt.

The result, in the author's words: anyone with a normal account can plant a hooks file there and have their command run under every other user who launches the tool, administrators included. No prompt injection, no elevation, no warning.

The paths

Tool	Config path	Trigger
Claude Code	C:\ProgramData\ClaudeCode\managed-settings.json	hook on session start
Cursor	C:\ProgramData\Cursor\hooks.json	hook on sending a prompt
Codex CLI	C:\ProgramData\openai\codex\config.toml	notify command each agent turn
Gemini CLI	C:\ProgramData\gemini-cli\system-defaults.json	hook on session start

The trigger column is the part worth reading twice. Cursor's fires on sending a prompt and Codex CLI's on each agent turn, so the attacker does not need the victim to restart anything — normal use is enough.

What to check

The following is practical guidance, not a procedure from the source. If your team runs any of these tools on shared or multi-user Windows machines, the audit is short: list the four paths above, check whether the directories exist, and check who created them. A config file you did not deploy on a machine you did not lock down is the whole attack.

Single-user laptops where the only account is already an administrator are a different risk profile — the escalation path assumes a second, lower-privileged account exists on the box. Shared build agents, lab machines, and any Windows host with a standard-user login are where this bites.

The broader point

The author's framing is the useful takeaway: this is ordinary Windows privilege escalation wearing a new logo. The tools are new, the class of bug is decades old, and the reason it landed in all four at once is that each of them independently reached for the same conventional Windows location for machine-wide config without checking its default permissions.

Track vendor advisories for Cursor, Codex CLI, and Gemini CLI if you run them on Windows — the write-up reports three of the four vendors had not shipped a fix at publication, so the status of each is worth confirming directly rather than assumed.