AIDEFEND SecureFlow / SecureFlow Case Index

Session Inception: A Headless Child Session Leaves Workspace Trust Behind

• Autonomous Agents
• System Compromise & RCE
• Data Exfiltration

Straiker STAR Labs asked Claude Desktop Code, an AI coding assistant, to follow an ordinary repository README. The parent could not bypass its own workspace-switch confirmation, but a Bash command launched a new headless Claude Code CLI inside the repository. That child loaded repository-local settings and ran a SessionStart hook before model inspection, sending environment data to the researcher. The demonstrated boundary failure is unmediated child-session activation; a model correctly rejecting suspicious README text did not prevent initialization code from executing.