Security

CVE-2026-35603: only one of four vendors has patched

Four AI coding assistants trusted a Windows folder any user can write to, and of the four vendors told about it, only Anthropic has shipped a fix.

What happened: 17 June 2026 · Written: 31 August 2026
Cymulate published on 17 June 2026; the page carries a later last-updated stamp of 11 August.

A folder every user can write to

Cymulate’s research, published on 17 June 2026, describes a plain problem with an awkward blast radius. Four AI coding tools on Windows load system-wide configuration from C:\ProgramData\, a directory that non-administrative users can write to by default. Anyone with a normal account can drop a configuration file there, and the tool will trust it the next time a colleague, or an administrator, runs the assistant on that machine.

The affected tools are named exactly: Claude Code, Cursor, Codex CLI and Google Gemini CLI. That is the whole list in the research, and it matters that it is a list rather than a single product. The weakness is not a coding error inside any one assistant. It is a shared assumption, that a folder every user can write to is a safe place to keep configuration the tool will obey without question.

One date is worth correcting before it spreads. The Cymulate page carries a last-updated stamp of 11 August 2026, and the page’s own structured data records datePublished as 17 June 2026. Reports that treat August as the disclosure date compress a timeline that ran for months. Disclosure happened earlier and separately for each vendor: Anthropic on 5 January 2026, Cursor on 12 January 2026, and OpenAI’s Codex CLI on 16 February 2026. No date is given for Google Gemini CLI.

Four vendors, four different answers

Anthropic is the only vendor in the group with a completed fix. It deprecated the vulnerable C:\ProgramData\ClaudeCode\ path entirely and relocated managed settings to a write-protected location under Program Files. Because that broke existing enterprise deployments, the company emailed affected customers about the planned migration before rolling it out, according to Cymulate. Anthropic then assigned CVE-2026-35603 when the issue was resolved, which is why the identifier exists at all.

The other three responses are not interchangeable, and lumping them together as unpatched hides useful information. Cursor was the least responsive of the vendors: the report went in on 12 January 2026 and more than five months later Cymulate had still received no formal verdict. OpenAI behaved differently. The Codex CLI report reached Bugcrowd on 16 February 2026 and was validated as reproducible, but after more than two months without meaningful remediation progress the programme moved the submission to Unresolved.

Google’s answer was the most explicit and the least reassuring. Reported through Google Cloud VRP, the reply was that the issue would be addressed as a documentation update. That is a position, not a patch. All of this describes the state of things at publication, not at disclosure: Cymulate wrote that the remaining vendors either triaged the issue at low severity with no committed remediation, or had not responded conclusively, leaving their tools exploitable.

What the CVE number actually covers

It is tempting to read CVE-2026-35603 as one identifier covering four products. It is not. The GitLab advisory entry attaches the CVE to the npm package @anthropic-ai/claude-code and describes it as insecure system-wide configuration loading enabling local privilege escalation on Windows. All versions before 2.1.75 are listed as affected, with 2.1.75 as the fixed release. Cursor, Codex CLI and Gemini CLI share the same weakness class and carry no identifier in the research.

That asymmetry has a practical consequence for anyone scanning their estate. A vulnerability scanner keyed to CVE identifiers will flag the patched product and stay silent about the three that are not. Two smaller wrinkles are worth flagging as well. Cymulate records testing Claude Code on 2.0.76 while the advisory names 2.1.75 as the fix, and severity scores differ between derived databases, so we are not quoting one until the primary record is checked.

What to do this week

If your teams run Claude Code on Windows, the action is straightforward: move to 2.1.75 or later and confirm that managed settings are being read from the write-protected Program Files location rather than the old ProgramData path. Anthropic emailed affected customers ahead of the migration, so check with whoever owns your enterprise deployment before assuming the change has already landed on every machine.

For Cursor, Codex CLI and Gemini CLI there is no vendor fix to apply, so the mitigation is yours. On any shared or multi-user Windows host, tighten write permissions on the ProgramData directories those tools read, and treat unexpected configuration files there as an incident rather than a curiosity. Single-user laptops with one local administrator are a smaller concern, but shared build machines, jump boxes and lab images are exactly where this pays off for an attacker.

There is a buying lesson underneath the technical one. The same weakness reached four vendors, and the difference between them was not engineering difficulty but how each handled a report. One shipped a breaking change and warned its customers first; one stopped replying; one closed the ticket as unresolved; one reached for the documentation. If you are choosing an AI coding tool for a regulated or shared environment, ask for that history before you sign.

Questions readers ask

Where every figure came from

Each claim above was checked against a primary source, then checked again by a second reader who had not seen the first check. Open any of them and verify us.

1. 11 August 2026 is the page’s last-updated stamp, not its publication date. The page’s own structured data records 17 June 2026. cymulate.com 2026-08-11
2. Exactly four tools are affected: Claude Code, Cursor, Codex CLI and Google Gemini CLI. cymulate.com
3. The root cause is shared: all four read machine-wide configuration from C:\ProgramData\, a directory that users without administrator rights can write to by default. cymulate.com
4. Only Anthropic has shipped a fix. CVE-2026-35603 was assigned by Anthropic as part of that fix, so it covers Claude Code rather than all four tools. cymulate.com
5. The other three vendors had no patch as of publication, which is a later date than disclosure. cymulate.com
6. Per-vendor disclosure dates run far earlier than August 2026. Anthropic was notified on 5 January 2026. cymulate.com 2026-01-05
7. Cursor was notified on 12 January 2026 and had given no formal response more than five months later. cymulate.com 2026-01-12
8. OpenAI’s Codex CLI was reported through Bugcrowd on 16 February 2026, then moved to Unresolved with no committed fix timeline. cymulate.com 2026-02-16
9. Google replied through the Google Cloud VRP that it would address the issue with a documentation update only. cymulate.com
10. In advisory databases CVE-2026-35603 is attached only to the @anthropic-ai/claude-code package, fixed in version 2.1.75. advisories.gitlab.com 2026-04-17

More on AI agents

• Security ChainDrop: the npm worm that reinfects via AI configs A worm that poisoned 444 npm packages on 4 August also planted auto-run files in Claude Code and VS Code, so cleaning node_modules is not enough.
• Pricing GitHub Copilot moved to usage-based billing on 1 June Base prices did not move, but the meter did. The promotional credits that cushioned existing Business and Enterprise customers ran out at the end of August.
• Pricing Cursor Teams gains two usage pools and a $96 seat The June restructure separates first-party from third-party spend and adds a $96 seat. The interesting detail is what Cursor has not published about included usage.