Exploitable only if · read by Claude, the source remains the reference
Claude Code version between 2.0.68 and before 2.1.260 for Claude for Enterprise organizations, or from 2.1.38 and before 2.1.260 for Claude for Work (Team) organizations.
Organization relies on server-managed settings (not only endpoint-managed MDM or file-based settings).
The session is authenticated with a valid Claude Enterprise or Team sign-in.
An API key stored by Claude Code (e.g., from an earlier /login or written to its configuration) exists on the device and is rejected by the settings endpoint.
Attacker has local access to the device with the stored API key.