A Journey into Claude's Sandbox

* Claude described its sandbox as running in gVisor inside a container on Ubuntu 24.04.4 LTS.
* The environment included mounted directories like `/mnt/skills/private` for FSI-focused data.
* Claude revealed the path `/processapi`, which is a Rust-compiled ELF binary acting as the sandbox control daemon.
* `/processapi` manages process lifecycle, FUSE mounts, cgroups, and host communication via WebSockets.
* The internal container IP was `192.0.2.2/24` with gateway `192.0.2.1`.
* A file download API accepted an absolute path to retrieve the `/processapi` binary.
* Memory inspection of PID 1 revealed fragments of EdDSA and RS256 JSON Web Tokens associated with Anthropic and Google service accounts.
* The local-origin restriction on `/processapi` was bypassed by using `CAPNETADMIN` and `CAPNETRAW` to configure a virtual interface.
* A virtual network interface was configured from the container IP, allowing connections that bypassed localhost restrictions.
* Enterprise control findings involved profile changes being editable via the account API, though Anthropic deemed this informational or a duplicate.
* Six observations were submitted through the bug bounty process.

The sequence of discovery demonstrates a systemic breakdown between the advertised security boundaries of an AI service and the reality of its execution environment. The investigation moved from external observation (asking about the sandbox) to deep internal exfiltration (reading memory and downloading binaries), highlighting that detailed system introspection, when prompted correctly, can reveal infrastructure details that are intentionally obscured. The core pattern here is the successful chain linkage: context provided by the model $\rightarrow$ revealing an internal artifact ($\text{/process\api}$) $\rightarrow$ exploiting the exposed artifact to gain credentials (JWTs) $\rightarrow$ bypassing network restrictions ($\text{CAP\NET\ADMIN}$) $\rightarrow$ achieving arbitrary execution or data access. This flow suggests that while high-level security controls are in place, the mechanisms managing the sandbox and host communication possess exploitable internal complexity, particularly concerning the separation between the sandboxed execution environment (gVisor) and the host orchestration layer. The response from Anthropic dismissing the sandbox findings as not meeting their threat model creates a significant tension: what is considered a "sandbox" for an AI system, and where does the responsibility for securing the underlying infrastructure truly lie? The focus shifts from direct vulnerability disclosure to advocating for fundamental changes in trust boundaries, specifically demanding that isolation mechanisms be enforced across all layers of interaction, including memory access and network configuration, regardless of the perceived utility of those settings.
Autonomy check: No autonomy signals.