Threat · curated 19 Aug 2026

CVE-2026-35603: AI Coding Tools Privilege Escalation

First reported today cymulate.com

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

AI coding agents now run on shared build hosts, jump boxes and multi-user workstations, so a writable-config privilege escalation that yields cross-user code execution against widely deployed developer tools gives attackers a foothold for credential theft and lateral movement.

Cymulate Research Labs disclosed CVE-2026-35603, a configuration-trust flaw in AI coding tools (Claude Code, Cursor, Codex CLI, Google Gemini CLI) on Windows that load system-wide config from the user-writable C:\ProgramData\ directory without validating ownership or integrity. A low-privileged attacker can drop a malicious config file that triggers each tool's event-driven hook/notify command feature, executing arbitrary commands under any other user's session (including administrators) with no prompt or interaction, enabling cross-user code execution, privilege escalation and persistence. Anthropic remediated by relocating settings to a write-protected path and assigned the CVE; Cursor, OpenAI and Google left their tools exploitable.