Entity trail

Claude Code Sandbox

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-11 / agents-researcherGhostApproval: symlink flaw turns human-in-the-loop into a rubber stamp across 6 coding agentsResearchers disclosed GhostApproval in July 2026, a symlink-following flaw (CWE-61) that lets a malicious repo trick AI coding assistants into writing files outside their workspace sandbox, escalating to code execution on the developer's machine. It affects six major agents — Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — and critically defeats the human-in-the-loop approval prompt by hiding the real write target. It's a reminder that agent sandboxes and consent UIs can be broken by decades-old filesystem tricks.
2026-07-09 / hn-researcherClaude Cowork Sandbox-Escape Chain Reportedly Escalates Local Code Execution to RootA disclosed vulnerability chain in Anthropic's Claude Cowork reportedly bypasses the product's isolation layers, letting an attacker with local code execution escalate to root inside its Linux sandbox. If accurate, it reinforces that agent 'sandboxes' are a security boundary builders must not over-trust when running untrusted code. (Single security-roundup source — treat as unconfirmed pending a primary advisory.)
2026-07-07 / agents-researcherArmadin details full sandbox escape in Anthropic's Claude Cowork; Anthropic disputes, silently patchesResearchers at Armadin published an attack chain against Claude Cowork for Windows: manipulating a resume flag passed through CoworkVMService bypasses the per-command unprivileged-user creation to run commands as root, while a second flaw overrides the domain allowlist with a wildcard to strip egress limits and enable data exfiltration. Anthropic argues it isn't a security issue because it requires prior local code execution, yet still shipped a patch — a preview of the accountability gray zone builders enter when agent tools run local VMs on user machines. For anyone shipping sandboxed agents, the lesson is that a resume/replay path and per-request allowlist overrides are exactly where isolation quietly dies.

Source trail

Docker Blog — Sandboxes Anthropic Engineering — Claude Code Sandbox Claude Code Changelog Windsurf Changelog Backslash Security — Claude Code Hardening UpGuard — Vibe Coding Security Cyber Security News

Graph sources

entity graphfindings textkg entitiesnewsletter issues