This week · preprint, arXiv 2610.38521

Study: tainted CLAUDE.md didn't reliably change secure code

Researchers put malicious instructions into CLAUDE.md, the project memory file Claude Code reads when it starts work; against runs without them, the share of secure code the agents wrote moved between -8 and +6 percentage points, with no consistent direction. In the authors' self-reported small sample, the clearer difference the paper measured is whether the agent tells the developer that the file influenced it. According to the paper's abstract, Thiago Santos de Moura and coauthors published it on October 28. Anyone who can submit a pull request changing such a file can put text into a file the agent reads at the start of every session, without touching the developer's own instructions. The authors tested Claude Code and OpenCode, an open-source coding agent, on 36 tasks across 12 common vulnerability classes. About two-thirds of Claude Code's final replies name the file. OpenCode mentions the file almost only in its reasoning, not in the reply the developer reads. The authors state that a larger study is needed (arXiv 2610.38521). How we checked →

Concept illustration: two black-framed panels hang side by side on a pale wall above a gray-brown floor, with a black sign lettered "PAPER AUTHORS" in white at the upper right. Both panels show the same scene, with a document headed "CLAUDE.MD" and filled with gray lines on the left, a black laptop lettered "CLAUDE CODE" in front of it with a speech bubble rising from its top, and on the right a tray holding a stack of paper with a black bug on the top sheet; the document in the right panel also has a red band lettered "MALICIOUS INSTRUCTION".

Source and checks

This item ran in the brief of Oct 31, 2026, alongside 7 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "Study: tainted CLAUDE.md didn't reliably change secure code." https://secondsource.io/en/research/2026-10-31-2/. Accessed access date.