Claude Code network sandbox bypassed via null-byte injection
Researcher Aonan Guan disclosed a full bypass of the Claude Code network sandbox. The sandbox routes outbound traffic through a SOCKS5 proxy that validates hosts using a JavaScript endsWith() function against an allowlist.
The bypass uses a host containing a null-byte: attacker-host.com\x00.google.com. The JavaScript filter reads the full string and approves it as ending in .google.com. However, the underlying libc getaddrinfo() terminates the string at the null-byte and resolves the blocked attacker-host.com.
The bug affected versions v2.0.24 through v2.1.89, spanning approximately 130 releases over 5.5 months. Anthropic patched the issue in v2.1.90 without mention in the release notes, and no CVE was assigned. Via prompt injection, an attacker could have exfiltrated keys, source code, and secrets past the allowlist.
Related stories
- Claude Code 2.1.282 ignores telemetry set by project files
- Two Claude Code sessions ate 32% of a team's bill
- One git call let a repo escape the Claude Code sandbox
- Claude Code opens network hosts one command at a time
- Stolen session keys are draining Claude Max accounts
- Claude Code under grith: 0.27% of calls reach a human
Comments
No comments yet. Be the first.
Join the conversation
Sign in with Google to leave a comment. Your name and avatar come from your Google profile, and the comment appears after moderation.