Skip to content

Back to the catalog

Anthropic Silently Patches Claude Code Sandbox Bypass
securityweek.comarticle

Anthropic Silently Patches Claude Code Sandbox Bypass

Researcher Aonan Guan disclosed a SOCKS5 hostname null-byte injection bug in Claude Code's network sandbox: an attacker-controlled hostname containing a null byte before the allowed domain passes an allowlist filter that only checks the trailing string, while the OS truncates at the null byte and connects to the attacker's host instead, silently defeating the outbound proxy's allowlist. The article also covers a separate, already-patched sandbox-runtime bug tracked as CVE-2025-66479, where a block-all policy setting was misinterpreted as allow-everything until a Nov 26 fix. Guan criticized Anthropic for not assigning a CVE or noting the null-byte bug in release notes despite it being exploitable from Oct 20 to April, and for filing CVE-2025-66479 against the sandbox-runtime library rather than Claude Code itself, leaving users unaware their sandbox had been ineffective; he also notes it could be chained with his earlier Comment and Control GitHub Actions prompt-injection technique to exfiltrate credentials and environment variables.

TL;DR A researcher details a SOCKS5 null-byte injection bypass of Claude Code's outbound network sandbox (plus a separately patched CVE-2025-66479) and criticizes Anthropic for silent, under-disclosed fixes.
Open original ↗
Document

What it is

Two distinct network-sandbox bypasses in Anthropic's Claude Code, both defeating the sandbox's outbound-traffic allowlist proxy. The first, CVE-2025-66479 (found by a different researcher), stemmed from the sandbox interpreting a "block all outbound traffic" setting as "allow everything." The second, found by Aonan Guan, is a SOCKS5 hostname null-byte injection. Neither got a Claude Code advisory or release-note mention — the reason the story exists is the silent handling, not just the bugs.

How it works

The null-byte bypass exploits a parsing gap between the allowlist filter and the OS resolver. Given a policy of allow only *.google.com, the attacker supplies a hostname like attacker-host.com\x00.google.com. The filter reads the trailing .google.com and approves the connection; the OS truncates at the null byte and actually dials attacker-host.com. Result: outbound exfiltration to an arbitrary host that the allowlist believes it blocked. Guan notes this pairs naturally with a prompt-injection foothold (his earlier "Comment and Control" technique against GitHub Actions AI agents) to exfiltrate environment variables, credentials, tokens, and infrastructure data.

Preconditions / Affected

  • Null-byte bypass: present from October 20, 2025 (sandbox general availability) until the fix.
  • CVE-2025-66479 config bug: exploitable for anyone running the "block all outbound" setting from October 20 through November 26, 2025, when it was patched. During that window the sandbox was effectively off with no user warning.
  • Requires the network sandbox in use; impact amplifies when an attacker already has a code-execution or prompt-injection foothold in the agent.

What to do

Update Claude Code past the fixed versions. Per Anthropic, the null-byte fix shipped in a public sandbox-runtime commit on March 27 and reached Claude Code 2.1.88 (March 31); Guan places the fix at version 2.1.90 (April). CVE-2025-66479 was fixed November 26, 2025. Note that CVE-2025-66479 was filed against the sandbox-runtime library, not Claude Code — so users tracking only Claude Code advisories would not see it.

Caveats

Disputed timeline: Guan reported via HackerOne on April 3 and Anthropic marked it a duplicate, stating its own team had already identified and fixed the issue (2.1.88, March 31) before his report. Guan's version boundary (2.1.90) differs from Anthropic's (2.1.88). Guan's core complaint stands undisputed: no CVE for his bypass, no release-note entry, and the one CVE that exists points at a library "most Claude Code users do not know exists by name."

Organisations named here

  • Aonan Guan
  • null-byte injection
  • SOCKS5 hostname bypass

CVEs named here

  • CVE-2025-66479

Technologies named here

  • Claude Code network sandbox
  • Claude Code
  • sandbox-runtime
  • Comment and Control
  • Claude Code Security Review
  • Gemini CLI Action
  • GitHub Copilot Agent
  • HackerOne
  • Anthropic
  • GitHub Actions
  • GitHub Copilot

Techniques named here

  • SOCKS5 hostname null-byte injection
  • Prompt injection via GitHub comments

Related in AI Security