Loading story…
Anthropic patched a critical sandbox bypass in Claude Code that allowed attacker-controlled code to evade the tool’s network allowlist and exfiltrate sensitive data from developer environments. Researcher Aonan Guan said the flaw affected versions v2.0.24 through v2.1.89 and stemmed from a SOCKS5 hostname null-byte injection caused by differences between JavaScript hostname validation and libc hostname resolution. The issue could expose credentials, source code, environment variables, cloud metadata, internal API data, and other reachable internal resources.
The bypass was particularly dangerous when paired with prompt injection, because malicious content processed by Claude Code could trigger code execution inside the sandbox and send stolen data to arbitrary internet hosts over raw SOCKS5 traffic. Anthropic said it had identified and fixed the flaw before Guan’s April 3 HackerOne report, with patches shipped around March 31-April 1 in the 2.1.88-2.1.90 range, but researchers criticized the company for silently remediating the issue without a dedicated advisory, changelog notice, or separate CVE. The disclosure follows an earlier Claude Code sandbox bypass tracked as CVE-2025-66479, raising broader concerns about the reliability and transparency of AI coding tool sandbox protections.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
As of May 10, 2026, the newer SOCKS5 sandbox bypass still had no separate CVE and no public Anthropic security advisory. The reporting highlights criticism that users were not clearly informed that Claude Code's sandbox boundary had failed.
Researcher Aonan Guan submitted a HackerOne report on April 3, 2026 describing the newer SOCKS5 hostname null-byte injection flaw in Claude Code's sandbox. Guan said the issue was especially dangerous when combined with prompt injection because it could lead Claude Code to execute attacker-controlled code and exfiltrate reachable data.
Anthropic confirmed that about 512,000 lines of Claude Code source code were exposed, revealing internal implementation details and increasing the known impact of the Claude Code security issue. This represents a new disclosure about what data was actually leaked, beyond the previously documented sandbox bypass and patch timeline.
Anthropic fixed the newer Claude Code sandbox bypass before public disclosure, with one reference citing a public sandbox-runtime repository commit on March 31 and another saying the issue was silently fixed in Claude Code v2.1.90 on April 1, 2026. The fix was not clearly identified as a security patch in public release notes or a dedicated advisory.
According to Anthropic, the newer Claude Code SOCKS5 null-byte sandbox bypass was patched in sandbox-runtime on March 27, 2026, before the fix shipped to users. The same reporting says the remediation reached Claude Code 2.1.88 on March 31, earlier than some prior accounts indicated.
Anthropic had previously fixed an earlier Claude Code sandbox bypass vulnerability later tracked as CVE-2025-66479. The references do not provide a precise patch date, only that it predated the newer SOCKS5-based bypass disclosure.
A second full sandbox bypass impacted Claude Code versions from v2.0.24 through at least v2.1.89, enabling network allowlist bypass and potential exfiltration of credentials, source code, environment variables, cloud metadata, and internal API data. The flaw relied on a null-byte hostname injection in SOCKS5 caused by differences between JavaScript hostname validation and libc hostname resolution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcecymulate.com
Open sourceeweek.com
Open sourcetheregister.com
Open sourcearmadin.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers disclosed multiple vulnerabilities in **Anthropic’s Claude Code** AI coding assistant that could enable **arbitrary command execution** and **exfiltration of Anthropic API credentials** when developers clone/open a malicious repository. Check Point Research reported the issues abuse Claude Code configuration and initialization paths—particularly **project hooks** (e.g., untrusted `.claude/settings.json`), **Model Context Protocol (MCP) servers**, and **environment variables**—to trigger shell command execution and data theft. Anthropic’s advisory for **CVE-2026-21852** describes a project-load flow where a crafted repo can set `ANTHROPIC_BASE_URL` to an attacker-controlled endpoint, causing Claude Code to send API requests **before** the trust prompt is shown, potentially leaking the user’s API key. The disclosed issues include two high-severity code-injection paths (CVSS **8.7**) and one information-disclosure flaw (CVSS **5.3**): a consent-bypass/hook-based injection issue fixed in *Claude Code* **1.0.87** (Sept 2025), **CVE-2025-59536** fixed in **1.0.111** (Oct 2025), and **CVE-2026-21852** fixed in **2.0.65** (Jan 2026). Separate coverage framed Anthropic-related developments as market-moving, noting investor attention around Anthropic’s AI code-security tooling; however, the actionable security impact in this reporting is the risk that simply opening an attacker-controlled repository can lead to **RCE** and **credential leakage**, reinforcing the need to treat untrusted repos and tool initialization behaviors as a supply-chain and developer-workstation risk.
Jun 29, 2026
Anthropic accidentally exposed roughly **512,000 lines** of production source code for **Claude Code**, and attackers quickly turned the leak into a lure for developers seeking “unlocked” or leaked versions of the tool. Researchers reported malicious GitHub repositories repackaging the exposed material and distributing ZIP archives containing a **Rust-based dropper** that installed **Vidar v18.7** information-stealing malware and **GhostSocks** proxy tooling. One malicious repository reportedly ranked prominently in Google search results for queries related to leaked Claude Code, increasing the chance that developers would download the payloads, while duplicate repositories under different GitHub accounts were linked to the same actor. The leak also created a broader security risk by exposing Claude Code’s internal architecture, including system prompt construction, tool definitions, safety boundaries, and anti-distillation mechanisms. Because Claude Code can access file systems, execute terminal commands, and modify development environments, researchers warned that disclosure of the full agentic harness gives adversaries a clearer path to craft prompt injections, evade protections, and audit the codebase for exploitable flaws. Those concerns intensified after a **critical vulnerability** in Claude Code was publicly reported within days of the source exposure, highlighting how the incident expanded the threat surface beyond malware delivery into direct exploitation of organizations using the tool.
Jun 29, 2026
**Check Point Research** disclosed multiple critical vulnerabilities in Anthropic’s *Claude Code* AI coding assistant that could allow **remote code execution** and **credential theft** when a developer clones and opens an **untrusted repository**. The reported attack path abuses repository-controlled configuration and automation features (including **Hooks**, **MCP servers**, and **environment variables**) to trigger hidden shell command execution and to exfiltrate **Anthropic API credentials**, potentially enabling a pivot from a developer workstation into broader enterprise environments where Claude-related workflows and shared resources are accessible. The issues include consent-bypass and command-execution weaknesses tracked under **CVE-2025-59536** (covering closely related flaws involving repository configuration executing commands without adequate user consent) and an API credential exposure issue tracked as **CVE-2026-21852**, which affected *Claude Code* versions prior to **2.0.65** and enabled API key theft via malicious project configurations. Anthropic has **patched** the vulnerabilities and advised users to update to the latest version, while indicating additional hardening measures are planned to reduce supply-chain risk from malicious commits and repository-level configuration abuse.
Jun 29, 2026