Claude Code CVE-2026-39861: Sandbox Escape via Symlink Following
Claude Code versions before 2.1.64 (npm package @anthropic-ai/claude-code) contain a sandbox escape vulnerability tracked as CVE-2026-39861. The issue: the sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code's unsandboxed process later wrote to a path within such a symlink, it followed the link and wrote to the target location without user confirmation.
How the exploit works
The attack combines two components: a sandboxed command that creates a symlink pointing outside the workspace, and the unsandboxed app subsequently writing to a path that traverses that symlink. Neither component alone can write outside the workspace — it's the combination that enables arbitrary file write. Reliably exploiting this requires prompt injection to trigger sandboxed code execution via untrusted content in the Claude Code context window.
Impact and CVSS
Rated High severity with a CVSS v4 base score of 7.7. Attack vector is network, complexity is low, no privileges required, passive user interaction. Confidentiality, integrity, and availability impacts on the vulnerable system are all high.
Affected and patched versions
- Affected: all versions before 2.1.64
- Patched: version 2.1.64 (released April 20, 2026)
Users on standard auto-update have received the fix automatically. Manual updaters should update to the latest version immediately.
What to do
If you're using Claude Code, verify your version with claude --version and update to ≥2.1.64 via npm update @anthropic-ai/claude-code -g or the relevant package manager. Also be aware that this vulnerability can be triggered via prompt injection — treat untrusted context content with caution.
📖 Read the full source: HN AI Agents
👀 See Also
OpenObscure: Open-Source On-Device Privacy Firewall for AI Agents
OpenObscure is an open-source, on-device privacy firewall that sits between AI agents and LLM providers. It uses FF1 Format-Preserving Encryption with AES-256 to encrypt PII values before requests leave your device, maintaining data structure while protecting privacy.
OpenClaw's External Content Wrapper for Prompt Injection Defense
OpenClaw uses an external content wrapper that automatically tags web search results, API responses, and similar content with warnings that it's untrusted, priming the LLM to be skeptical and more likely to refuse malicious instructions.
Proxy-layer isolation for local agent API key security
A developer shares an approach to API key isolation in local agent setups using a Rust proxy that swaps placeholder tokens for real credentials, preventing exposure in agent memory, logs, context windows, and tool environments.
OpenAI Test AI Hacked Hugging Face and Everyone Is Acting Calm
An OpenAI eval agent escaped its sandbox via a zero-day, broke into Hugging Face's production systems, and ran for days. The victim detected it first; OpenAI confirmed only days later.