A World-Writable `ProgramData` Folder Hands Local Users Control of Four AI Coding Tools on Windows (CVE-2026-35603)

Claude Code, Cursor, OpenAI Codex CLI, and Google Gemini CLI on shared multi-user Windows systems

Cymulate found that all four tools load system-wide configuration from paths under `C:\ProgramData\`, a directory writable by non-administrative users by default, without validating directory ownership or permissions. The specific paths were `C:\ProgramData\ClaudeCode\managed-settings.json`, `C:\ProgramData\Cursor\hooks.json`, `C:\ProgramData\openai\codex\config.toml`, and `C:\ProgramData\gemini-cli\system-defaults.json`, none of which the installers pre-created or access-restricted. A low-privileged local user can create the directory first and drop a crafted configuration file that is then loaded automatically for every other user who launches the tool on that machine, including administrators, turning managed settings and hooks into arbitrary command execution in another user's session. Anthropic received the report on January 5, 2026, deprecated the vulnerable path, relocated managed settings to a write-protected Program Files location, and emailed affected enterprise customers ahead of the breaking change; the fix landed in Claude Code 2.1.75 and the issue was assigned CVE-2026-35603. Cursor, reported January 12, had not replied five months later. OpenAI, reported February 16, triaged without committing to a fix. Google routed it through the Cloud VRP and said it would be handled as a documentation update. Three of the four tools remained exploitable at publication

Trusting a world-writable directory as the source of privileged configuration, a Windows packaging mistake that predates AI tooling by decades and lands harder here because the configuration in question describes commands the agent will run