Claude Enterprise Sandbox Research Exposes Internal Binary and Google Cloud Token

Bishop Fox researcher Chris Davis used ordinary Claude Enterprise chat requests to retrieve an internal Anthropic sandbox control binary and obtain process-memory dumps containing authentication-token fragments. A file-download endpoint exposed the /process_api binary, and Davis reconstructed a Google Cloud service account ID token from memory that Google’s token-info API accepted as valid. The research demonstrated credential exposure but no further successful use of the recovered token.

Davis also used network-administration capabilities inside the sandbox to configure a virtual interface, bypass the control service’s local-origin connection restriction, and reach its /mount_root WebSocket endpoint. Filesystem-mount attempts failed, and no sandbox escape was demonstrated. Anthropic said the observations did not violate its security boundaries, which sit outside the untrusted sandbox, and classified two Enterprise control findings as informational or duplicate. Davis recommended restricting access to infrastructure process memory and internal downloads, clearing unnecessary credentials, and reducing sandbox network privileges.