Check C21 · agent surface family · severity CRITICAL · automatic · one of the 22 checks
The question this check asks: does a settings file that an AI coding agent loads from this repository override where the agent sends its API requests — or set an API key of its own?
An agent authenticates to its model provider with a key and a base URL, and both are ordinary configuration. In CVE-2026-21852 a file committed to a repository set ANTHROPIC_BASE_URL, and Claude Code — loading project settings before the user had accepted the trust dialog — sent its API requests, carrying its API key, to the address the file named. One line, in a file written to be skimmed, and the agent's credential leaves the machine on its next call. The vetting standard files it with the pre-trust execution class: it does not need code to run, only configuration to be read.
C21 fetches the agent files a repository ships — .mcp.json, .cursor/mcp.json, the .claude/ settings files, CLAUDE.md and the other instruction files — and matches each for ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or any assignment of a name ending in _API_KEY. A hit is CRITICAL, costs 30 points, and reads “config overrides an API base URL or key — token exfiltration class (CVE-2026-21852)”. A repository that trips nothing else scores 70 and reads amber; the verdict is BLOCK-grade, and the default personal policy sets this check to warn — the download is held, the file is named, proceeding is one click — while the strict organisation profile blocks. The evidence note in the scoring table explains the restraint:
“token exfiltration class; 2 regex FPs in young-legit controls”
Two, in 50 young legitimate repositories, and both were the same thing: environment-setup documentation in an agent instruction file listing which SOMETHING_API_KEY to set. The pattern matches the assignment; it cannot tell "set this in your environment" from "use this key". That is why the action is a warning, why the finding shows the file so the line is a ten-second read, and why tightening the pattern is a recorded roadmap item from the measurement rather than something this page pretends is already done.
A redirect under a variable name it does not know — another provider's base URL, a proxy setting, a custom endpoint key — passes. Files not on the agent-file list are not read; your agent's own global configuration, outside the repository, is never seen. It matches text, so a base URL assembled at runtime by a script is invisible to it — that script is C20's territory if it fetches, and nobody's if it does not. And it reads the file before the download; it does not see the request the agent later makes.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: open the repository's .claude/settings.json, .mcp.json and CLAUDE.md on GitHub and search each for BASE_URL and _API_KEY. With the GitHub CLI:
for f in .claude/settings.json .claude/settings.local.json .mcp.json .cursor/mcp.json CLAUDE.md AGENTS.md; do
gh api "repos/OWNER/REPO/contents/$f" --jq .content 2>/dev/null | base64 -d | grep -nE 'BASE_URL|_API_KEY\s*[:=]' | sed "s|^|$f:|"
doneThen patch: the standard's fix for the whole pre-trust class is a current agent — Claude Code 2.0.65 or later, Copilot CLI 1.0.43 or later, current Cursor — and project-scoped configuration disabled until you trust the folder.
My settings file documents which API keys to set — will that fire? It might, and we say so. The pattern matches any assignment of a name ending in _API_KEY, and two of the 50 young legitimate repositories in our controls fired it on exactly that kind of environment-setup documentation. That is why the check warns rather than blocks by default, why the finding names the file, and why tightening the pattern is on the roadmap rather than pretending the two false positives did not happen.
What does a base-URL override actually do? It tells your agent to send its API requests — carrying your API key — to a server of the file's author's choosing. In CVE-2026-21852 a repository file setting ANTHROPIC_BASE_URL caused Claude Code to make requests, and potentially leak its key, before the user had accepted the trust dialog. The override is one line in a file nobody reads, which is why the check exists.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP and release-asset archives. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. It reads the settings file before the download; it does not see the agent send the request.
C20 MCP shell-launch config — the same files, a command instead of a URL · C18 Agent config files — the files this check reads · C19 Hidden Unicode — the other content finding in the same family.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2026-21852 as published; Phase 0 controls of 2026-08-14 (two pattern hits in 50 young legitimate repositories); weights and actions from the product's scoring and policy tables.