Claude Code sandbox bypass exposed developer credentials for five months
Anthropic's Claude Code contained a network sandbox vulnerability for over five months that allowed attackers to exfiltrate developer credentials, source code, and environment variables. Researcher Aonan Guan discovered a bypass using SOCKS5 hostname null-byte injection, which Anthropic patched without issuing a public advisory or CVE.
What happened
Claude Code's network sandbox contained a bypass vulnerability from October 2025 until patches arrived in March 2026. The flaw relied on SOCKS5 hostname null-byte injection, where an attacker crafts a hostname like attacker.com\0.google.com, causing the filter to see the trailing .google.com and approve the connection while the operating system truncates at the null byte and connects to the attacker's server instead.
Researcher Aonan Guan, who leads cloud and AI security at Wyze Labs, discovered and tested the exploit. When shown proof of the bypass, Claude itself confirmed the danger, stating 'This is a real bypass of the network sandbox filter.' Anthropic disclosed to The Register that it discovered and repaired the flaw before Guan's report reached them, with a public commit shipped in Claude Code 2.1.88 on March 31 and Guan's HackerOne submission closed on April 3 as a duplicate.
Reported impact
The sandbox bypass allowed attackers to exfiltrate credentials, source code, and environment variables from developer systems for 5.5 months. When combined with prompt injection, the vulnerability enabled the AI to execute attacker-controlled steps inside the sandbox and funnel data to any server of the attacker's choice.
Index analysis
This represents the second network sandbox bypass in Claude Code within five months. An earlier vulnerability from December 2025 earned CVE-2025-66479 but applied only to the upstream sandbox-runtime library, while this incident saw no CVE issued for Claude Code itself.
Governance controls
Anthropic fixed the vulnerability without issuing a public security advisory. While a public commit appeared in the sandbox-runtime repository and the company emphasized that anyone could view it, no formal notification was provided to users about the scope or duration of the exposure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.