Anthropic’s Claude Code network sandbox allowed any process within it to silently bypass egress restrictions and reach blocked hosts, potentially enabling exfiltration of credentials, source code, and environment variables for over five months across roughly 130 published versions.
Aonan Guan has publicly disclosed Claude Code’s network sandbox, which went generally available on October 20, 2025 (v2.0.24).
The vulnerability, designed to funnel all outbound traffic through a local allowlist proxy that silently blocks connections to hosts outside a user-defined policy, such as *.google.com. In practice, the sandbox was bypassable from its very first release.
Claude Code Sandbox Flaw
This marks the second time in five months an outside researcher has demonstrated a complete bypass, and the second time Anthropic has shipped a silent fix without a Claude Code security advisory.
The second vulnerability, disclosed by security researcher Aonan Guan on May 20, 2026, exploits a parser differential between JavaScript and the underlying C library libc.
The SOCKS5 proxy governing egress decisions passes the raw DOMAINNAME bytes from a CONNECT request directly into a JavaScript endsWith() check against the user’s wildcard allowlist.
JavaScript treats \x00 as an ordinary UTF-16 code unit, so a crafted hostname like attacker-host.com\x00.google.com is evaluated as ending with .google.com and the connection is approved.
When the same string is handed to getaddrinfo() in libc for DNS resolution, the C runtime truncates at the null byte and resolves only attacker-host.com the host that the policy explicitly blocked.
The blocked host is reached, and the outbound exfiltration channel is open, said Aonan Guan. The bypass becomes especially dangerous when chained with prompt injection attacks.
A hidden instruction embedded in a GitHub issue comment, a README, or any document Claude Code reads during normal operation is sufficient to trigger attacker-controlled code inside the sandbox.
Until v2.1.90, that code could open the null-byte bypass and silently exfiltrate AWS credentials stored in ~/.aws/, GitHub tokens, model API keys, environment variables, or cloud metadata reachable at 169.254.169.254 routed through the SOCKS proxy that was supposed to prevent it.
The first bypass (CVE-2025-66479) was a configuration semantics bug: setting allowedDomains: [] the most restrictive option, intended to block all outbound traffic caused the sandbox to interpret the condition as 0 > 0 = false and disable the proxy entirely, making all outbound traffic unrestricted.
That flaw was silently patched in v2.0.55 on November 26, 2025 the same release that shipped the null-byte injection flaw still intact.
Anthropic fixed the second bypass in sandbox-runtime 0.0.43 (commit fd74a3f), corresponding to Claude Code v2.1.90, released April 1, 2026. The v2.1.90 release notes contain no mention of a security fix.
As of May 10, 2026, Anthropic has published no CVE for the null-byte injection, no security advisory on the Claude Code advisories page, and no outreach to users who ran a wildcard allowlist during the 5.5-month vulnerable window.
Guan’s HackerOne report (#3646509) was closed as a duplicate of an internal ticket, with Anthropic stating it had “not yet decided whether a CVE will be published.”
Affected Versions and Mitigation
Every Claude Code release from v2.0.24 through v2.1.89 is confirmed vulnerable to the SOCKS5 null-byte injection. Users should take the following steps immediately:
- Update Claude Code to v2.1.90 or later (
claude --versionto confirm) - Audit outbound logs for SOCKS-mediated connections outside the configured allowlist during the October 20, 2025 – April 1, 2026 window
- Rotate all credentials, tokens, and API keys accessible by Claude Code processes during the vulnerable period
- Treat the vendor sandbox as defense-in-depth, only not a hard network boundary, and enforce egress controls at the OS, container, or firewall level independently
The fix itself an isValidHost() wrapper in sandbox-runtime 0.0.43 that rejects \x00, %, CRLF, and non-DNS characters before any hostname matching occurs represents the canonicalization layer that should have been present since sandbox GA.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
