# Claude Code Sandbox Bypass Silently Patched: Anthropic's Disclosure Failure Raises Security Questions
A critical vulnerability in Anthropic's Claude Code network sandbox was quietly fixed without public disclosure, CVE assignment, or user notification—leaving organizations potentially unaware they may have operated with a non-functional security boundary for months. The vulnerability, discovered by security researcher Aonan Guan, represents a SOCKS5 hostname null-byte injection that could have allowed attackers to bypass network restrictions and exfiltrate sensitive data when chained with prompt injection attacks.
## The Threat
Claude Code's network sandbox is designed to act as a gating mechanism for all outbound network traffic, enforcing a local allowlist proxy that blocks connections to unapproved hosts. The vulnerability discovered by Guan provides a method to circumvent this protection entirely.
Vulnerability Details:
The attack is elegantly simple in execution. If a policy restricts outbound connections to *.google.com, an attacker could craft a hostname like attacker-host.com\x00.google.com. The filtering mechanism examines the string, identifies the .google.com suffix, and approves the connection. However, when the operating system processes the hostname, it truncates at the null byte (\x00), connecting to the attacker's actual destination: attacker-host.com.
## Background and Context
This vulnerability exists within a broader pattern of Claude Code security challenges. It follows CVE-2025-66479, another network sandbox bypass discovered separately and patched in November 2025. That earlier vulnerability stemmed from misinterpretation of a security setting, where a configuration intended to block all outbound traffic was instead read as permitting everything.
The timing is particularly significant given concurrent research into AI agent exploitation. Guan recently disclosed "Comment and Control," a prompt injection attack method that compromises AI code security tools through specially crafted GitHub comments, pull request titles, and issue bodies. This attack successfully targeted:
The vulnerability window for the null-byte injection was substantial. The Claude Code network sandbox became generally available on October 20, 2025. Guan's vulnerability remained unpatched for approximately six months until a fix was released in version 2.1.88 on March 31, 2026—days before he submitted his report through Anthropic's HackerOne bug bounty program on April 3.
## Technical Details
Understanding the null-byte injection requires examining how modern software handles string parsing across different layers of the system.
The Vulnerability Chain:
| Layer | Processing | Result |
|-------|-----------|--------|
| Application Proxy Filter | Examines full string including null byte | Approves based on .google.com suffix |
| Operating System Socket | Truncates string at first null byte | Dials attacker-host.com |
| Network Connection | Establishes connection to attacker's host | Bypass complete |
The sandbox's filtering logic evaluated the entire hostname string before passing it to the OS network layer. Since the string technically contained the approved domain, it passed validation. However, SOCKS5 protocol handling at the OS level follows C-string convention, truncating at the null byte and interpreting only the portion before it.
Attack Scenario:
An attacker combining this sandbox bypass with Comment and Control prompt injection could:
1. Inject a specially crafted GitHub comment into a repository where Claude Code runs
2. Trigger a prompt injection that executes code within Claude Code's environment
3. Use the null-byte hostname injection to establish outbound connection to attacker infrastructure
4. Exfiltrate environment variables, API credentials, authentication tokens, and infrastructure data
The vulnerability is particularly dangerous because Claude Code operates with access to environment secrets, API keys, and integration tokens—all attractive targets for lateral movement or credential harvesting.
## Implications for Organizations
The Disclosure Failure:
Anthropic's handling of this vulnerability raises several concerns:
Guan noted the practical impact: "A team running [the vulnerable configuration] in production from October 20 through November 26 had no way to know the sandbox was effectively off, and no notice afterwards that it had ever been off. The CVE shipped against a library most Claude Code users do not know exists by name."
Risk Assessment:
Organizations should consider:
## Recommendations
For Claude Code Users:
1. Verify Versions: Confirm all Claude Code deployments are running version 2.1.88 or later
2. Audit Proxy Logs: Review network proxy logs for suspicious SOCKS5 connection attempts or null-byte encoded hostnames
3. Credential Rotation: Rotate any credentials or tokens that could have been accessed during the vulnerability window
4. Environment Scanning: Audit environment variables and secrets accessible to Claude Code processes
5. Configuration Review: Verify sandbox network policies are correctly configured and test with known-safe/unsafe domains
For AI Security Teams:
1. Prompt Injection Hardening: Implement additional safeguards against Comment and Control and similar attacks
2. Network Isolation Testing: Conduct regular adversarial testing of sandbox implementations with null-byte and encoding variations
3. Dependency Tracking: Monitor security updates not just in primary packages but in all transitive dependencies
4. Supply Chain Monitoring: Track patches to underlying libraries and correlate with application-level impact
For Anthropic:
1. Establish transparent disclosure policies for sandbox vulnerabilities with mandatory CVE assignment
2. Provide advance notification to Claude Code users when security boundaries may have been compromised
3. Publish detailed technical guidance on vulnerable configurations and how to detect them
4. Consider security scanning tools to detect common sandbox bypass patterns in user configurations
---
## HackWire Analysis
This incident exemplifies a troubling pattern in how AI security vendors handle vulnerability disclosure. The technical vulnerability itself—a null-byte injection—is neither novel nor particularly sophisticated. What makes this concerning is Anthropic's apparent decision to treat it as a non-event requiring no disclosure, CVE assignment, or user notification.
Anthropic's statement that the vulnerability was "identified and fixed before receiving the researcher's report" misses the fundamental point: end users had no indication the fix was necessary or that a security boundary they relied upon had been broken. This inverts the purpose of vulnerability disclosure, which serves not to praise vendors for fixing bugs, but to inform stakeholders of risks they may face.
The broader context sharpens the concern. We're observing a emerging pattern of sandbox bypass vulnerabilities in AI tooling (CVE-2025-66479 followed weeks later by this null-byte injection). Researchers are simultaneously demonstrating how to chain prompt injection attacks with these bypasses for full compromise. Yet disclosure remains fragmented—some vulnerabilities get CVEs and warnings, others get silent patches, and users are left to figure out their exposure independently.
The six-month gap from general availability to patch is significant. Organizations deploying Claude Code as part of secure development pipelines likely did so because they trusted the sandbox guarantees. Operating for half a year with those guarantees silently broken creates a genuine security incident for any customer, whether or not they happened to suffer actual compromise. The absence of disclosure meant no opportunity for informed decision-making, no chance to compensate with additional controls, no way to audit for suspicious activity knowing what to look for.
For defenders, the lesson is clear: vendor silence about security boundaries should not be mistaken for vendor assurance. Verify sandbox configurations directly, test them adversarially, and maintain network monitoring that could detect null-byte and encoding-based bypass attempts. For the industry broadly, the incident underscores why AI security tooling requires the same mature disclosure practices, CVE discipline, and transparency that traditional security software has adopted over decades.
— HackWire Editorial
---
## Related Coverage