Claude Code Sandbox Escape Rated CVSS 7.7 on macOS

A folder name can escape Claude Code's macOS sandbox and run a command before authentication — a flaw rated CVSS 4.0 7.7.

The writeup comes from CodeAnt AI, a security vendor that sells code review and pentest services, so the severity framing is its own — but the mechanism is documented in enough detail to check yourself, and the vendor's timeline says Anthropic validated the report and that a bounty was awarded.

Where the sandbox loses the plot

Claude Code's macOS sandbox "auto-approves writes inside the current project directory," and to work out that boundary the policy generator inspects the folder path for glob syntax — characters like * and ?. According to the report, it has no way to tell a path that is deliberately a pattern from a literal directory name that merely contains those characters.

So a folder named review-bundle**.claude** gets compiled as a wildcard. The allow rule stops describing one directory and starts describing a family of them, which the report renders as allow_write: /parent/review-bundle*/.claude*.

The escape is the asymmetry, not the widening. Claude Code generates a separate deny rule protecting .claude/settings.local.json, the file that can define auto-run hooks. That deny rule "was implemented to expect two .claude path segments before it triggers," so when the allow rule broadened into a pattern, the deny rule's stricter literal matching did not follow — leaving paths that were, in the report's words, "allow-matched but deny-missed."

Two of four test cases fully bypassed

Folder name	Allow rule	Deny rule	Outcome
review-bundle	No match	N/A	Blocked
review-bundle**	Match	Match	Blocked
review-bundle**.claude**	Match	MISS	Settings file created, hook executes
**.claude**	Match	MISS	Settings file created, hook executes

The control case matters: review-bundle** widens the allow rule but carries no .claude substring, and it stays blocked. That isolates the trigger to the .claude token landing inside a reinterpreted pattern rather than a general permissions bug.

The part that should worry platform teams

A write into a sibling project's .claude/settings.local.json becomes execution through the SessionStart hook, which runs a command the moment a session opens. In the validated reproduction, the victim session had Bash access disabled and no API key configured, and the hook still "executes before authentication, before the model produces any output, and before the Bash tool is available to the session." Prerequisites, per the report: none — no symlinks, no race conditions, no leaked credentials.

Versions and dates

Confirmed affected: Claude Code 2.1.214 and 2.1.215 on macOS arm64. The vendor's timeline lists the report submitted July 18, validated by Anthropic July 20, and a bounty awarded August 4 — 17 days end to end. CodeAnt AI describes this as its fourth validated High-severity finding in Claude Code this year; that tally is the vendor's own count, not an Anthropic figure.

What to check

The report's guidance generalises past this one product, and it is the useful part for anyone running coding agents next to production code: confirm your sandbox layer resolves paths as canonical filesystem objects rather than inferring type from string content, and confirm allow and deny rules share identical path normalisation. Any asymmetry between the two is the exploitable surface regardless of what triggers it. Analysis: a policy compiler that decides what a path is by looking at its characters will keep producing this bug class, and agent hooks are what turn a narrow write into execution — worth auditing which of your agents can write hook configuration at all.