Claude AI Exposes Internal Sandbox Details That Help Researcher Bypass Local Connection Restrictions

A Bishop Fox researcher investigating Claude’s sandbox obtained an internal control binary, recovered authorization tokens from process memory, and bypassed a local connection restriction to reach a sandbox control service.

Anthropic said the sandbox observations did not qualify as security issues because its security boundaries sit outside the untrusted sandbox.

According to technical research published by Bishop Fox, the investigation began with a question about whether Claude ran inside a virtual machine.

Claude described a gVisor container, mounted directories, networking details, and an internal executable named /process_api, providing leads for subsequent testing.

Claude AI sandbox restrictions

Claude identified /process_api as the container’s PID 1 process: a Rust-based control daemon managing process lifecycles, filesystem mounts, resource controls, and WebSocket communication with surrounding infrastructure.

The researcher then requested the executable through Claude’s conversation file-download API. Supplying its absolute filesystem path returned the internal binary, rather than restricting downloads to intended user-facing directories.

Reverse engineering helped establish how the daemon communicated with the orchestrator. Separately, Claude fulfilled a request to export PID 1 memory, exposing fragments of JSON Web Tokens.

A custom extraction script reconstructed missing token material and verified signatures using Google’s public OAuth keys. The recovered material included Anthropic-issued EdDSA tokens and Google Cloud service-account ID tokens. Google’s token-information endpoint accepted a reconstructed Google token, according to the report.

The findings echo concerns raised in Claude Code credential-exposure research, where agent-accessible file reads exposed sensitive runtime information despite protections applied elsewhere.

The daemon used –block-local-connections to reject connections originating inside its own container. However, the sandbox retained CAP_NET_ADMIN and CAP_NET_RAW, enabling network configuration changes.

After receiving a networking hint, Claude configured a virtual interface and connected using a different source address. The control service subsequently returned HTTP 101 Switching Protocols, confirming a WebSocket upgrade at /mount_root.

This demonstrated a bypass of the local-origin restriction, not a successful host compromise. Filesystem-mount attempts failed, and the researcher reported no further successful use of the recovered tokens.

The distinction matters when comparing this investigation with separate Claude Code network-sandbox findings, which concerned outbound filtering rather than access to this internal control service.

Anthropic rejected the sandbox-related submissions under its stated threat model. A separate Enterprise profile-editing finding was considered informational because the affected name field was not used for auditing; another Enterprise issue was marked duplicate.

The researcher recommended restricting infrastructure-process memory access, limiting downloads to approved directories, removing unnecessary network capabilities, and strengthening local-origin checks.

The broader lesson is that individually accessible sandbox features can combine into deeper control-plane visibility without establishing that an external security boundary was crossed.

Those limits remain central to interpreting the demonstrated behavior and its security significance.