Case claude-code-symlink-escapeAgent hijackUnited States
Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861)
A sandboxed Claude Code process could create symlinks outside the workspace that the unsandboxed process then followed and wrote to without confirmation, letting prompt injection reach host code execution.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 21, 2026
- Location
- United States
- Target
- Anthropic Claude Code (before 2.1.64)
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2026-39861
What happened
A sandboxed Claude Code process could create symlinks outside the workspace that the unsandboxed process then followed and wrote to without confirmation, letting prompt injection reach host code execution.
Impact: Potential host compromise for developers running Claude Code on untrusted content; not known exploited
Who triggered it
Actor: Unknown
Attribution: Coordinated disclosure to Anthropic; CVSS 4.0 score 7.7
Motive: Security research
How it happened
Attack vector: Prompt injection instructs the sandboxed agent to create a symlink; path traversal through the link bypasses workspace restrictions
Root cause: Unsandboxed file writer followed symlinks created by the sandboxed process without canonical path checks
Timeline
- Fix shipped in Claude Code 2.1.64
- CVE-2026-39861 published to NVD
Response
Anthropic patched and published a GitHub security advisory
Current status: Patched
Sources (open in a new tab)
- SentinelOne vulnerability database sentinelone.com
- Phoenix Security phoenix.security
Cite this case
Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861). AI Threat Watch, case claude-code-symlink-escape, Apr 21, 2026. https://aithreat.io/cases/claude-code-symlink-escape/
Permanent link: https://aithreat.io/cases/claude-code-symlink-escape/