CVE-2026-54316 is a vulnerability in Anthropic's Claude Code that allows an attacker to exfiltrate API keys one character at a time using Hugging Face's public download counter as a covert channel. The flaw affects all versions from 0.2.54 to 2.1.163 and is fixed in 2.1.163. Anthropic rates it Moderate (CVSS 6.0), while NVD assigns a 9.1 CVSS v3.1 score.