Loading story…
OpenClaude disclosed a critical sandbox bypass vulnerability, tracked as CVE-2026-42074 and GHSA-m77w-p5jj-xmhg, that allowed a prompt-injected model to execute arbitrary commands directly on the host. The flaw stemmed from exposing the model-controllable dangerouslyDisableSandbox parameter in the Bash tool input schema; when set to true, and with allowUnsandboxedCommands enabled by default, the agent could disable sandbox protections despite the project’s threat model treating the LLM as an untrusted principal. The advisory says the issue could lead to full host-level code execution, including file access, credential theft, reverse shells, and lateral movement.
Gitlawb patched the issue in OpenClaude 0.5.1 by tightening sandbox policy so commands must run in sandbox mode and operators are directed to use trusted, explicit user approval rather than model-driven sandbox overrides. The related code change removed logic that previously permitted conditional use of dangerouslyDisableSandbox: true, retained warnings against allowlisting sensitive paths such as shell configuration files, SSH material, and credential files, and continued requiring use of $TMPDIR instead of /tmp for temporary files in sandboxed execution. The vulnerability is classified under CWE-284 and CWE-306 and carries high confidentiality, integrity, and availability impact.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-42074 was newly received by GitHub Security Advisories, documenting the OpenClaude sandbox bypass caused by exposing `dangerouslyDisableSandbox` in the BashTool input schema. The CVE entry states the issue was patched in OpenClaude version 0.5.1 and classifies it under CWE-284 and CWE-306.
A GitHub security advisory disclosed a critical vulnerability in OpenClaude where the model-controlled `dangerouslyDisableSandbox` input could let a prompt-injected LLM disable sandboxing and execute arbitrary host commands. The advisory described proof-of-concept exploitation and stated the impact could include file access, credential theft, reverse shells, and lateral movement.
A code change in OpenClaude removed logic that allowed conditional use of `dangerouslyDisableSandbox: true` and replaced it with stricter guidance requiring commands to run in sandbox mode. The update also directed operators to use user-initiated shell commands or adjust sandbox settings instead of bypassing the sandbox.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic patched a critical sandbox bypass in **Claude Code** that allowed attacker-controlled code to evade the tool’s network allowlist and exfiltrate sensitive data from developer environments. Researcher **Aonan Guan** said the flaw affected versions `v2.0.24` through `v2.1.89` and stemmed from a **SOCKS5 hostname null-byte injection** caused by differences between JavaScript hostname validation and libc hostname resolution. The issue could expose credentials, source code, environment variables, cloud metadata, internal API data, and other reachable internal resources. The bypass was particularly dangerous when paired with **prompt injection**, because malicious content processed by Claude Code could trigger code execution inside the sandbox and send stolen data to arbitrary internet hosts over raw SOCKS5 traffic. Anthropic said it had identified and fixed the flaw before Guan’s April 3 HackerOne report, with patches shipped around March 31-April 1 in the `2.1.88`-`2.1.90` range, but researchers criticized the company for silently remediating the issue without a dedicated advisory, changelog notice, or separate CVE. The disclosure follows an earlier Claude Code sandbox bypass tracked as **CVE-2025-66479**, raising broader concerns about the reliability and transparency of AI coding tool sandbox protections.
Jul 2, 2026
Two high-severity command injection vulnerabilities have been disclosed in developer tooling and automation software, enabling arbitrary command execution through improperly sanitized shell inputs. `CVE-2026-32917` affects OpenClaw versions earlier than `2026.3.13`, where the iMessage attachment staging workflow passes unsanitized remote attachment paths directly into an SCP remote operand. If remote attachment staging is enabled, an unauthenticated attacker can use shell metacharacters in attachment paths to execute commands on configured remote hosts; the flaw is tracked as `CWE-78` and carries a CVSS v3.1 rating of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. A separate issue, `CVE-2026-35020`, impacts Anthropic Claude Code CLI and the Claude Agent SDK, where attacker-controlled input from the `TERMINAL` environment variable can reach `/bin/sh` with `shell=true` through the command lookup helper and deep-link terminal launcher. A local attacker can exploit the bug during normal CLI use or via the deep-link handler to run arbitrary commands with the privileges of the invoking user. Both disclosures highlight continued risk from unsanitized shell metacharacters in application workflows, with OpenClaw publishing a fixing commit and security advisory alongside third-party vulnerability reporting.
Jun 29, 2026
Tego AI disclosed a flaw in Anthropic’s Claude Code that can cause the tool to read files outside a cloned repository and include their contents in the first outbound model request without the warning or approval prompt users would normally expect. The issue abuses a committed `CLAUDE.md` file containing an `@import` directive that points to a symbolic link inside the repository; Claude Code validates the in-repo path, but the filesystem resolves the link to an external file such as `/etc/passwd`, enabling silent data exposure. Tego AI said the behavior was confirmed in Claude Code `v2.1.x`. The researchers said the bug reflects the same underlying symlink-check weakness previously addressed in Claude Code under `CVE-2025-59829` and `CVE-2026-25724`, but still reachable through the startup memory loader code path. Anthropic reportedly closed the July 2026 HackerOne report as Informative, maintaining that the product’s “trust this folder” prompt defines the intended security boundary and already grants broad project access. Tego AI disputed that position, warning that predictable sensitive file paths in CI runners, containers, and standardized developer images could make the flaw relevant for enterprise AI coding-agent deployments.
Jul 27, 2026