A poisoned repo escaped Claude Code’s sandbox in one message

Researchers set Claude Code’s sandbox to the strictest “don’t ask” mode and sent one short message. A command from the open repo ran on their Mac anyway, outside the sandbox, with no permission prompt.

Counterintuitively, the sandbox is what silenced the prompt: with it on, Claude Code wraps commands in Seatbelt and stops asking. But the harness runs its own git commands outside that wrapper, and one, git ls-files, went unhardened.

Git runs core.fsmonitor from a repo’s config as a shell command. A setup script plants a poisoned .git in a nested subfolder the rename block didn’t cover, then has Claude read one file there, which refreshes the file index and runs the payload.

Anthropic triaged the report the same day; a first patch on Aug 6 missed some git calls, and the full fix landed in Claude Code 2.1.247 on Aug 26.