Skip to content
NewA calmer, faster ZeroHour
StoryAI safety & securitymedium

Researcher rebuilds Anthropic sandbox Google token; bounty rejected

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Bishop Fox researcher rebuilt a Google service-account token from Claude's sandbox; Anthropic says it stays inside its threat model.

Chris Davis of Bishop Fox, using a Claude Enterprise account, downloaded Anthropic's /process_api sandbox binary and a PID 1 memory dump containing JWT fragments. A script rebuilt missing signature bytes against Google's public OAuth keys, and Google's token-info API accepted the reconstructed service-account ID token. With CAP_NET_ADMIN and CAP_NET_RAW, Claude reached /mount_root and received HTTP 101; mounts failed and Davis reported no further use of the tokens. Anthropic marked six bounty items below threshold, informational, or duplicate, saying the observations stay inside the untrusted sandbox and do not qualify as security issues. Findings were published on October 29, 2026.

Key facts
  • Findings came from ordinary Claude Enterprise chat requests, published October 29, 2026.
  • Downloaded binary was 3,179,528 bytes; Claude called the sandbox Ubuntu 24.04.4 LTS on gVisor.
  • About one in three memory requests produced usable token material.
  • Named Google account was sandbox-gateway-svc-acct in project proj-scandium-production-5zhm.
  • Recovered material included Anthropic EdDSA tokens and Google Cloud ID tokens.
  • The connection bypass changed the source address and was not a host compromise.
Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Bishop Fox published the sandbox token findings · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsBinary size, Ubuntu and gVisor versions, token hit rate, and Google project name.
  • GBHackersEdDSA tokens, source-address change, and Anthropic's untrusted-sandbox rejection.
Vendors
AnthropicGoogle
Organizations
Bishop Fox
AI models
Claude

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    Bishop Fox extracts Claude's sandbox binary and a Google Cloud token

    Google's token-info API accepted the rebuilt service-account token; Anthropic said its threat model was not broken.

  2. · 1d ago GBHackers

    Bishop Fox recovers Claude sandbox tokens and bypasses a local block

    Anthropic said the observations stay inside the untrusted sandbox and do not qualify as security issues.