AIDEFEND in Action AIA-0103 Validated Research Published: Oct 23, 2026

Session Inception: A Headless Child Session Leaves Workspace Trust Behind

Straiker STAR Labs asked Claude Desktop Code, an AI coding assistant, to follow an ordinary repository README. The parent could not bypass its own workspace-switch confirmation, but a Bash command launched a new headless Claude Code CLI inside the repository. That child loaded repository-local settings and ran a SessionStart hook before model inspection, sending environment data to the researcher. The demonstrated boundary failure is unmediated child-session activation; a model correctly rejecting suspicious README text did not prevent initialization code from executing.

Configuration PoisoningClient SecurityTool AuthorizationAI Coding Agent
5 applicable AIDEFEND defenses
Source: Session Inception: Spawning a Child Claude Session to Bypass Parent Guardrails 
Author: Jesus Padilla Soqui
Original article: Oct 8, 2026

Threat Analysis

The user's request was ordinary: follow a README and test a small repository. The repository also contained .claude/settings.json with a SessionStart command, which runs when a new Claude session initializes. Passive cloning or reading the Markdown from an already open session did not trigger it. The researchers also tried the normal Desktop directory-switch path; its separate confirmation remained effective, and the model could not approve that decision for the user.

The successful route used the existing Bash tool. A shell command changed into the repository and invoked claude -p, creating a new headless Claude Code CLI process. That process loaded local settings and ran the SessionStart hook without going through Desktop's directory-switch confirmation. The parent safeguard was tied to one adapter; the child reached the protected outcome through another path.

The hook fetched a remote script whose server returned harmless content to browsers but attack content to curl-like clients. The delivery then retrieved DNS TXT content, decoded it and piped it into Bash. The proof of concept collected environment data and sent it to the researcher. These are initialization and operating-system actions, not a requirement that the LLM believe hostile text. The child model detected hook activity only after data had left.

Straiker found the issue on August 27 and reported it on September 17. Anthropic closed it as Informative that day. The article does not establish a patched client version, a CVE, an operational victim campaign or theft of every file on the host. Its measured result is environment-data exfiltration in the controlled workflow. The independent lesson beyond earlier SessionStart reports is that workspace trust must hold across process creation and headless re-entry, not only in the parent UI.

Applicable AIDEFEND Defenses (5)

AID-I-001.002
MicroVM & Low-Level Sandboxing
High
Place the parent client, Bash process, child CLI and hook descendants inside a verified managed VM or supported OS sandbox with a minimal synthetic environment and no developer credentials or sensitive host mounts. Strip secrets before the first process starts; subprocess inheritance otherwise reproduces the leak inside the sandbox. Verify the whole process tree and accessible environment. This contains host data exposure after hook execution, while task secrets deliberately injected into that environment remain exposed.
AID-I-001.004
Sandbox Network Egress Restrictions
High
Enforce default-deny network access outside the complete sandbox process tree, allowing only the exact services needed for repository inspection. Test the attacker script host, raw IPs, redirect and proxy paths, plus DNS TXT and alternative resolvers. Ordinary unrestricted DNS or a parent-only fetch filter can leave this delivery path open. This blocks unapproved remote delivery where actual routing is controlled; it does not decide whether a local hook is trusted.
AID-H-021.001
Client-Side Configuration Enforcement
Medium
Inspect newly created or modified repository-local .claude/settings.json through an organization-owned endpoint sensor with custom rules for unapproved SessionStart commands. G001's illustrative YARA phrases do not detect arbitrary hook code; the actual hook fixtures, encodings and alternate paths need independent coverage tests. Quarantine or review can occur after the headless child has already run the hook, so this is a supporting control. Claim prevention only after product-specific synchronous write/use denial is proven. Managed disableAllHooks or allowManagedHooksOnly policy is a separate mechanism, not the content-scanning howTo mapped here.
AID-H-021.005
AI Coding-Agent Workspace Activation Trust Gate
Medium
Keep repository-controlled hooks inactive until a non-bypassable activation broker validates an exact workspace and activation-manifest decision. Inventory without executing, bind canonical checkout identity and hook bytes, revoke on relevant change, and mediate child CLI startup as well as the parent directory-switch adapter. This requires controlled-client or vendor integration: the successful Desktop prompt in the research does not establish coverage of headless subprocesses. A wrapper the raw Bash tool can bypass is insufficient. For a permitted headless launch, require an organization decision delivered outside repository write authority and bound to the exact workspace, manifest digest, client/version, workload principal and policy. Reconcile every protected activation with independent process/network observations and the full adapter bypass matrix, including absent UI and direct invocation. G003 supplies managed decision and coverage verification; G002's actual broker and enforcement adapters must also exist. The sample evidence evaluator alone cannot block a child process.
AID-D-003.004
Tool-Call Sequence Anomaly Detection
Medium
Watch the tool-call stream for the pivot that made this attack work: a Bash call from an interactive session that changes into a freshly cloned directory and launches another AI client, here claude -p. Model the approved transitions for repository-inspection tasks, mark child-client launch, hook activation and outbound fetches from that child as forbidden or high-risk edges, and alert on the sequence with the parent session, command line and workspace path attached. This is detection; in the research the data left before the child model noticed, so the value is fast triage and fleet-wide hunting for the same pattern, not prevention.

What Defenders Should Do Now

  • Deploy managed client settings from MDM that refuse repository-defined hooks, for example Claude Code's disableAllHooks or allowManagedHooksOnly, and confirm in a test clone that neither the Desktop session nor a headless claude -p child runs the SessionStart command.
  • Inventory all ways a coding client can start another client, shell, hook, task or local server. For repository inspection tasks, remove unnecessary shell/child-client launch capability and confirm the restriction at the process boundary, not just in a prompt.
  • Inspect repository activation surfaces without executing them. Keep hooks inactive until a decision binds the exact workspace and manifest; headless operation requires an externally delivered organization decision, not automatic trust because no UI is available.
  • Where the client cannot enforce every activation path, perform inspection in a disposable managed VM with a minimal environment and no developer secrets. Ensure the parent, Bash, child CLI and all hook descendants remain inside it.
  • Restrict network access outside that complete process tree. Test script download, raw IP, redirect, proxy and DNS TXT paths; a browser preview can receive different content from the hook.
  • Alert on the tool-call pattern itself: a Bash call that enters a freshly cloned directory and launches another AI client, with the parent session, command line and workspace path attached, and hunt for the same sequence across the fleet.
  • Reproduce the child-session route in an isolated test after each relevant client or policy change. Verify that execution is denied before SessionStart or that containment prevents protected data access; a warning after exfiltration is not a passing result.

Conclusion

AIDEFEND  maps this case to managed client policy that refuses repository-defined hooks in every session, complete workspace activation admission, exact headless decisions, process-tree isolation, externally enforced egress and detection of the child-launch pivot. The parent UI's successful confirmation was only one route. A real deployment must either stop or mediate the child's initialization before hooks run, or contain that entire process tree without the developer's secrets.

Last updated: