Claude CLI Suspicious Child Process

Tim Peck@timpeck

•updated Feb 25, 2026•4•0•60

Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.