Bishop Fox recovers Claude sandbox tokens and bypasses a local block
Original title: Claude AI Exposes Internal Sandbox Details That Help Researcher Bypass Local Connection Restrictions
Anthropic said the observations stay inside the untrusted sandbox and do not qualify as security issues.
A Bishop Fox researcher obtained Claude's internal /process_api control binary through the conversation file-download API, recovered authorization tokens from PID 1 memory, and bypassed a local-origin connection restriction to a sandbox control service. The sandbox kept CAP_NET_ADMIN and CAP_NET_RAW, and after a networking hint Claude reached /mount_root with an HTTP 101 WebSocket upgrade. Filesystem mounts failed, and the researcher reported no further use of the tokens. Anthropic rejected the sandbox submissions under its threat model.
Unconfirmed: Anthropic disputes that the sandbox findings cross a security boundary.
- Claude described a gVisor container and named /process_api as the Rust PID 1 daemon.
- Recovered material included Anthropic EdDSA tokens and Google Cloud service-account ID tokens.
- Google's token-information endpoint accepted a reconstructed Google token, the report says.
- The bypass changed the source address; it was not a host compromise.
- A separate Enterprise profile-name issue was informational; another was a duplicate.
Impact: Internal sandbox binary and cloud tokens exposed to the model user
| Product | Affected |
|---|---|
| Anthropic Claude sandbox | — |
- 1.Restrict downloads to approved directories and block model access to infrastructure-process memory.
- 2.Remove unnecessary network capabilities and strengthen local-origin checks.
- Organizations
- Bishop Fox
- AI models
- Claude
From the original article
2 min read at gbhackers.com
A Bishop Fox researcher investigating Claude’s sandbox obtained an internal control binary, recovered authorization tokens from process memory, and bypassed a local connection restriction to reach a sandbox control service. Anthropic said the sandbox observations did not qualify as security issues because its security boundaries sit outside the untrusted sandbox. According to technical research published […]
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.