Claude Code's network sandbox could be silently bypassed to exfiltrate credentials via a null-byte hostname trick

Anthropic / Claude Code users·Claude Code (network sandbox / sandbox-runtime)Fixed

Researchers found that Claude Code's outbound-traffic allowlist proxy could be tricked with a SOCKS5 hostname containing a null byte (e.g. 'attacker-host.com\x00.google.com'), which the filter approved by reading only the trailing allowed domain while the OS truncated at the null byte and dialed the attacker's host instead; a separate bug (CVE-2025-66479) had also made a 'block all outbound traffic' setting behave as 'allow everything' for over a month.

Blast radius

Combined with a prompt injection, the bypass could have let an attacker exfiltrate environment variables, credentials, tokens, and infrastructure data from any team running the affected sandbox configuration between October 20 and November 26, 2025 (first bug) or until Claude Code 2.1.88 (second bug).

Root cause

The sandbox's hostname-matching logic and the OS's own null-byte string truncation disagreed about where a hostname ended, letting a crafted name satisfy the allowlist while actually resolving elsewhere.

How it was caught

Independently found by two security researchers; one bug was fixed by Anthropic's own security team before a HackerOne report arrived, the other was reported externally.

What changed

Anthropic patched the sandbox-runtime library (commit March 27, shipped in Claude Code 2.1.88/2.1.90) but did not assign a CVE to the second bug or mention it in release notes.

Take-awayDon't assume an agent's network allowlist is enforced correctly just because it exists — test it against encoding tricks like null-byte or Unicode hostname confusion.