Claude Code Sandbox Flaw May Compromise User Secrets

A newly disclosed security flaw in Anthropic’s Claude Code platform has exposed a critical weakness in its network sandbox, potentially allowing attackers to bypass restrictions and exfiltrate sensitive data.

The issue, identified by security researcher Aonan Guan, marks the second complete sandbox bypass discovered in under six months, raising concerns about the reliability of built-in security controls.

Claude Code Sandbox Flaw

The vulnerability affects Claude Code versions from 2.0.24 through 2.1.89, spanning approximately 130 releases over months.

The flaw leverages a SOCKS5 hostname null-byte injection technique, enabling malicious code running inside the sandbox to access blocked external hosts, as reported by OddGuan.

In a typical secure configuration, users define outbound network restrictions using allowlists such as *.google.com. However, the flaw allows attackers to craft hostnames like:

attacker.com\x00.google.com

The sandbox’s JavaScript-based filter interprets this as a permitted domain due to the “.google.com” suffix.

Meanwhile, the underlying operating system truncates the string at the null byte (\x00), resolving the request to attacker.com instead. This mismatch between validation and resolution enables unauthorized outbound connections.

Successful exploitation allows attackers to bypass egress controls and exfiltrate any data accessible within the sandboxed environment. This includes:

• API keys and authentication tokens
• Environment variables and configuration files
• Source code and internal project data
• Cloud metadata endpoints and internal services

The risk becomes significantly higher when combined with prompt injection attacks. For example, a malicious instruction hidden in a GitHub issue or documentation file could trick Claude Code into executing attacker-controlled code.

Once executed, the sandbox bypass enables silent data exfiltration over SOCKS5 connections, potentially evading traditional HTTP-based monitoring.

The vulnerability stems from a classic parser differential issue, where two components interpret the same input differently:

• The sandbox proxy uses JavaScript string matching (endsWith)
• The OS resolver (libc getaddrinfo) treats null bytes as string terminators

This inconsistency creates a gap in enforcement, effectively breaking the security boundary that the sandbox is meant to provide.

Notably, this is the second major flaw affecting Claude Code’s sandbox. The earlier vulnerability (CVE-2025-66479) incorrectly treated an empty allowlist (allowedDomains: []) as “allow all,” instead of “block all.” Both issues resulted in full sandbox bypass./+

Anthropic addressed the null-byte injection issue in version 2.1.90, released on April 1, 2026. The fix introduces stricter hostname validation to reject malformed inputs, including null bytes and non-DNS characters.

However, no public security advisory, CVE assignment, or changelog mention accompanied the fix. Users remained unaware of the risk unless they independently analyzed the code or followed external research disclosures.

This lack of transparency is particularly concerning given the duration and severity of the vulnerability, as well as the potential exposure of sensitive data in real-world environments.

Mitigation and Recommendations

Organizations using Claude Code should take immediate action:

• Upgrade to version 2.1.90 or later
• Audit outbound network logs for suspicious SOCKS5 traffic
• Rotate credentials that may have been exposed
• Avoid relying solely on application-level sandboxes for security

Security experts recommend implementing additional layers of defense, such as external network controls, isolated execution environments, and strict credential management practices.

The repeated failure of Claude Code’s sandbox highlights a broader issue in AI tooling security. Built-in safeguards, particularly those enforcing network boundaries, should not be treated as primary defenses.

Instead, they must be complemented with external controls that remain enforceable even if the application layer is compromised.

As AI-assisted development tools become more integrated into sensitive workflows, ensuring robust and transparent security practices will be critical to preventing similar incidents in the future.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.