Critical Flaw in Claude Code’s Network Sandbox Exposes User Data

Key Takeaways

• A critical network sandbox bypass flaw was present in Anthropic’s Claude Code AI assistant for over five months.
• The vulnerability, a SOCKS5 null-byte injection, allowed attackers to exfiltrate sensitive data like credentials and source code.
• The issue affected Claude Code versions from v2.0.24 through v2.1.89 and was silently patched in v2.1.90 on April 1, 2026.
• Anthropic has not issued a public advisory or CVE for this specific bypass, despite its severity and potential for data exfiltration.

Critical Sandbox Bypass Endangers Claude Code Users

Anthropic’s Claude Code AI coding assistant harbored a severe network sandbox bypass for more than five months, creating a window for attackers to compromise developer systems. This critical flaw enabled the exfiltration of sensitive information, including credentials, source code, and environment variables. Despite the significant risk, Anthropic has not released a public advisory regarding this incident.

Security researcher Aonan Guan has publicly unveiled this second complete bypass of Claude Code’s network sandbox. Guan characterizes these incidents as indicative of consistent implementation failures rather than isolated defects, highlighting a recurring pattern in the product’s security architecture.

Technical Details of the SOCKS5 Null-Byte Injection

The vulnerability, identified as a SOCKS5 hostname null-byte injection, impacted all Claude Code releases from v2.0.24, which marked the general availability of the sandbox on October 20, 2025, up to v2.1.89. This critical flaw persisted across approximately 130 published versions over a span of roughly 5.5 months.

Anthropic quietly addressed the problem in version v2.1.90 on April 1, 2026. Notably, the release notes for this update made no mention of a security fix, leaving users unaware of the underlying vulnerability that had been resolved.

This bypass follows a previous sandbox bypass (CVE-2025-66479). In that instance, configuring allowedDomains: [], which was intended to block all outbound traffic, was misinterpreted by Claude Code as “allow everything” due to a faulty allowedDomains.length > 0 check. That earlier bug was also silently fixed in v2.0.55 on November 26, 2025, a version that paradoxically still contained the SOCKS5 null-byte injection vulnerability.

How the Attack Works

The attack leverages a parser differential between JavaScript and the underlying C library (libc). Claude Code’s sandbox routes outbound network traffic through a SOCKS5 proxy, which employs a JavaScript endsWith() check to validate hostnames against a user-defined allowlist, such as *.google.com.

An attacker can craft a malicious hostname, for example, attacker-host.comx00.google.com. The JavaScript filter, seeing the legitimate trailing .google.com, approves the connection. However, the libc‘s getaddrinfo() function, which handles the actual name resolution, interprets the null byte (x00) as a termination character, resolving the connection to attacker-host.com, an unauthorized host.

The vulnerable code in sandbox-runtime <= 0.0.42 directly passed raw DOMAINNAME bytes from a SOCKS5 CONNECT request to the matcher without any null-byte rejection, length limitations, or character whitelisting. The subsequent fix, implemented in sandbox-runtime 0.0.43, introduced an isValidHost() wrapper. This wrapper now rejects null bytes (x00), percent signs (%), CRLF characters, and other non-DNS characters before the hostname is passed to the matcher.

This bypass becomes particularly dangerous when combined with prompt injection attacks. A carefully crafted malicious instruction embedded within a GitHub issue comment, README file, or documentation that Claude Code processes could trigger attacker-controlled code within the sandbox. Prior to version v2.1.90, this code could exploit the bypass to surreptitiously exfiltrate:

• AWS credentials from ~/.aws/ and GitHub tokens from ~/.config/gh/.
• Cloud instance metadata from 169.254.169.254.
• Internal API endpoints and corporate intranet resources.
• Environment variables and model API keys, all transmitted via raw SOCKS5, thereby evading standard HTTP egress logs.

Lack of Transparency and Official Disclosure

Anthropic closed Guan’s HackerOne report (#3646509) as a duplicate, and as of May 10, 2026, has not published a CVE for the SOCKS5 bypass in either the NVD or the GitHub Advisory Database. CVE-2025-66479 remains the only recorded CVE for either sandbox vulnerability, and it was issued against sandbox-runtime, not Claude Code directly. The Claude Code security advisories page currently lists no sandbox vulnerabilities.

What You Should Do

• Users should update to Claude Code v2.1.90 or later immediately. Verify your version by running claude --version.
• Any user who operated Claude Code with a wildcard allowlist on a system containing credentials between October 20, 2025, and their upgrade date should thoroughly audit outbound SOCKS-mediated traffic logs.
• Rotate all potentially reachable credentials that may have been exposed during the vulnerable period.
• Treat vendor-provided sandboxes as a layer of defense-in-depth, not as a primary security boundary. Enforce egress controls at the network or hypervisor level, outside the agent’s direct control, for robust protection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.