Claude Code CLI API Redirection to Non-Anthropic Endpoint

Ethan Andrews@eandrews

•updated Feb 25, 2026•15•0•197

Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.