Anthropic Silently Patches Claude Code Sandbox Bypass

Why It Matters

The undisclosed sandbox weakness exposed enterprises using Claude Code to potential data leaks, highlighting gaps in AI‑tool supply‑chain transparency and vulnerability reporting standards.

Key Takeaways

• Anthropic patched Claude Code sandbox bypass in version 2.1.90 (April 2025).
• Vulnerability allowed null‑byte hostname injection to evade allowlist proxy.
• No CVE assigned; fix was hidden in sandbox‑runtime library release notes.
• Bypass could combine with prompt‑injection attacks to exfiltrate credentials.

Pulse Analysis

The recent discovery of a null‑byte hostname injection in Anthropic's Claude Code sandbox underscores a growing class of AI‑driven attack vectors. By manipulating the allowlist proxy, an attacker could present a crafted hostname like "attacker-host.com\0.google.com," tricking the filter into approving the connection while the operating system truncates at the null byte and reaches the malicious host. This bypass was active from the service’s general availability in October 2025 until the March 31, 2025 release of version 2.1.88, which incorporated the fix in the sandbox‑runtime library. Although Anthropic applied the patch before the researcher’s formal report, the lack of a CVE identifier and omission from public release notes left users unaware of the risk.

The vulnerability gains particular relevance when paired with prompt‑injection techniques such as the "Comment and Control" method disclosed by the same researcher. Prompt injection can coerce AI agents into executing unintended commands, and when combined with a sandbox bypass, it creates a conduit for exfiltrating environment variables, API keys, and other sensitive infrastructure data. This synergy illustrates how AI code‑generation tools, GitHub Actions, and other automation pipelines can become attack surfaces if their runtime environments are not rigorously isolated.

Anthropic's handling of the issue raises broader questions about responsible disclosure in the AI ecosystem. Assigning CVEs and clearly communicating fixes are essential for maintaining trust among enterprise customers who rely on AI assistants for critical workflows. As AI integration deepens across development and operations, vendors must adopt transparent vulnerability management practices, and organizations should proactively audit sandbox configurations and monitor for anomalous outbound traffic to mitigate similar threats.