Bishop Fox tadqiqotchisi Claude sandboxini tekshirish jarayonida ichki nazorat binar faylini qo'lga kiritdi, jarayon xotirasidan avtorizatsiya tokenlarini tikladi va sandbox nazorat xizmatiga kirish uchun mahalliy ulanish cheklovini chetlab o'tdi.
Anthropic sandbox kuzatuvlari xavfsizlik masalalari sifatida baholanmasligini aytdi, chunki uning xavfsizlik chegaralari ishonchsiz sandbox tashqarisida joylashgan.
Bishop Fox tomonidan e'lon qilingan texnik tadqiqotga ko'ra, tekshiruv Claude virtual mashina ichida ishlaydimi degan savol bilan boshlandi.
Claude gVisor konteyneri, o'rnatilgan kataloglar, tarmoq tafsilotlari va /process_api nomli ichki bajariladigan fayl haqida ma'lumot berdi, bu esa keyingi sinovlar uchun yo'l-yo'riq bo'ldi.
Claude /process_api ni konteynerning PID 1 jarayoni sifatida aniqladi: jarayon hayot siklini, fayl tizimi o'rnatishlarini, resurs nazoratini va atrofdagi infratuzilma bilan WebSocket aloqasini boshqaradigan Rust asosidagi nazorat demoni.
Keyin tadqiqotchi bajariladigan faylni Claude'ning suhbat fayl-yuklab olish API orqali so'radi. Uning mutlaq fayl tizimi yo'lini taqdim etish ichki binar faylni qaytardi, yuklab olishni mo'ljallangan foydalanuvchiga mo'ljallangan kataloglar bilan cheklash o'rniga.
Teskari muhandislik demonning orkestrator bilan qanday aloqa qilishini aniqlashga yordam berdi. Alohida, Claude PID 1 xotirasini eksport qilish so'rovini bajardi va bu JSON Web Tokenlarining parchalarini ochib berdi.
Maxsus ekstraksiya skripti yo'qolgan token materialini tikladi va Google'ning ochiq OAuth kalitlari yordamida imzolarni tekshirdi. Tiklangan material Anthropic tomonidan berilgan EdDSA tokenlari va Google Cloud xizmat hisobi ID tokenlarini o'z ichiga oldi. Hisobotga ko'ra, Google'ning token-ma'lumot nuqtasi tiklangan Google tokenini qabul qildi.
Topilmalar Claude Code hisob ma'lumotlari ochilishi tadqiqotida ko'tarilgan xavotirlarni aks ettiradi, bu yerda agentga kirish mumkin bo'lgan fayl o'qishlari boshqa joylarda qo'llanilgan himoyalarga qaramay sezgir ish vaqti ma'lumotlarini ochib qo'ygan.
Demon o'z konteyneri ichidan keladigan ulanishlarni rad etish uchun –block-local-connections dan foydalangan. Biroq sandbox CAPNETADMIN va CAPNETRAW ni saqlab qolgan, bu esa tarmoq konfiguratsiyasi o'zgarishlarini amalga oshirishga imkon bergan.
Tarmoq maslahatini olgandan so'ng, Claude virtual interfeysni sozladi va boshqa manba manzili yordamida ulanishni amalga oshirdi. Keyin nazorat xizmati HTTP 101 Switching Protocols javobini qaytardi, bu /mount_root da WebSocket yangilanishini tasdiqladi.
Bu mahalliy manba cheklovini chetlab o'tishni ko'rsatdi, muvaffaqiyatli xost buzilishini emas. Fayl tizimi o'rnatish urinishlari muvaffaqiyatsiz tugadi va tadqiqotchi tiklangan tokenlardan keyingi muvaffaqiyatli foydalanish haqida xabar bermadi.
Bu tekshiruvni alohida Claude Code tarmoq-sandbox topilmalari bilan solishtirganda farq muhim, ular ichki nazorat xizmatiga kirish emas, balki tashqi filtratsiya bilan bog'liq edi.
Anthropic sandbox bilan bog'liq arizalarni o'zining belgilangan tahdid modeliga muvofiq rad etdi. Alohida Enterprise profil tahrirlash topilmasi ma'lumot sifatida baholandi, chunki ta'sirlangan nom maydoni audit uchun ishlatilmagan; boshqa Enterprise masalasi dublikat deb belgilandi.
Tadqiqotchi infratuzilma jarayoni xotirasiga kirishni cheklash, yuklab olishni tasdiqlangan kataloglar bilan cheklash, keraksiz tarmoq imkoniyatlarini olib tashlash va mahalliy manba tekshiruvlarini kuchaytirishni tavsiya qildi.
Kengroq dars shundaki, alohida kirish mumkin bo'lgan sandbox xususiyatlari tashqi xavfsizlik chegarasi kesib o'tilganini isbotlamasdan chuqurroq nazorat tekisligi ko'rinishiga birlashishi mumkin.
Bu chegaralar namoyish etilgan xatti-harakat va uning xavfsizlik ahamiyatini talqin qilishda markaziy bo'lib qoladi.
A Bishop Fox researcher investigating Claude’s sandbox obtained an internal control binary, recovered authorization tokens from process memory, and bypassed a local connection restriction to reach a sandbox control service.
Anthropic said the sandbox observations did not qualify as security issues because its security boundaries sit outside the untrusted sandbox.
According to technical research published by Bishop Fox, the investigation began with a question about whether Claude ran inside a virtual machine.
Claude described a gVisor container, mounted directories, networking details, and an internal executable named /process_api, providing leads for subsequent testing.
Claude identified /process_api as the container’s PID 1 process: a Rust-based control daemon managing process lifecycles, filesystem mounts, resource controls, and WebSocket communication with surrounding infrastructure.
The researcher then requested the executable through Claude’s conversation file-download API. Supplying its absolute filesystem path returned the internal binary, rather than restricting downloads to intended user-facing directories.
Reverse engineering helped establish how the daemon communicated with the orchestrator. Separately, Claude fulfilled a request to export PID 1 memory, exposing fragments of JSON Web Tokens.
A custom extraction script reconstructed missing token material and verified signatures using Google’s public OAuth keys. The recovered material included Anthropic-issued EdDSA tokens and Google Cloud service-account ID tokens. Google’s token-information endpoint accepted a reconstructed Google token, according to the report.
The findings echo concerns raised in Claude Code credential-exposure research, where agent-accessible file reads exposed sensitive runtime information despite protections applied elsewhere.
The daemon used –block-local-connections to reject connections originating inside its own container. However, the sandbox retained CAPNETADMIN and CAPNETRAW, enabling network configuration changes.
After receiving a networking hint, Claude configured a virtual interface and connected using a different source address. The control service subsequently returned HTTP 101 Switching Protocols, confirming a WebSocket upgrade at /mount_root.
This demonstrated a bypass of the local-origin restriction, not a successful host compromise. Filesystem-mount attempts failed, and the researcher reported no further successful use of the recovered tokens.
The distinction matters when comparing this investigation with separate Claude Code network-sandbox findings, which concerned outbound filtering rather than access to this internal control service.
Anthropic rejected the sandbox-related submissions under its stated threat model. A separate Enterprise profile-editing finding was considered informational because the affected name field was not used for auditing; another Enterprise issue was marked duplicate.
The researcher recommended restricting infrastructure-process memory access, limiting downloads to approved directories, removing unnecessary network capabilities, and strengthening local-origin checks.
The broader lesson is that individually accessible sandbox features can combine into deeper control-plane visibility without establishing that an external security boundary was crossed.
Those limits remain central to interpreting the demonstrated behavior and its security significance.
