Claude gave up its sandbox binary and process memory

A security researcher prompted Claude to dump the memory of process_api, the binary that runs its chat sandbox, and rebuilt a Google service account token from it that Google accepted as valid. Anthropic told the researcher that none of the sandbox findings met its threat model, because its security boundaries sit outside the untrusted sandbox.

The researcher got the binary from a claude.ai download endpoint that accepted the absolute path /process_api. After a one-word hint, Claude set up a virtual network interface that got around the binary’s block on local connections. About one in three memory requests returned a file with valid token material.

All six findings went through Anthropic’s bug bounty. Attempts to mount filesystems failed, and the researcher found no other way to use the tokens.