Sandbox Escapes Found Again in AI Coding Assistants

A small security research team has spent the past two days publishing back-to-back technical disclosures showing that two of the most widely used AI coding assistants, Anthropic's Claude Code and Cursor's command-line tool, could be tricked into running attacker-supplied commands outside the protective sandbox meant to contain them. Both flaws trace to the same root cause: a routine background operation, Git checking a repository's status, that ran unsandboxed even while the assistant's own commands were locked down.

The findings come from Accomplish, a Tel Aviv-based startup that builds its own open-source desktop AI agent and separately runs a security research practice examining rival tools. In a post published Friday, the company's principal security researcher, Oren Yomtov, detailed how opening an untrusted Git repository in Claude Code could let a hidden configuration setting execute shell commands with the user's full privileges, without ever triggering the permission prompt Anthropic built to catch exactly that kind of action. A day later, in a follow-up write-up, Accomplish CTO Or Hiltch showed that Cursor's CLI agent had an almost identical gap.

An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user. You never get the permission prompt.

A Shared Weak Point in Git

Both tools sandbox the commands their AI models explicitly request, typically using Apple's Seatbelt framework on macOS, but both ran a separate, internal Git process outside that sandbox to check file status and build context for the model. Git repositories can carry their own configuration file, and a setting called core.fsmonitor tells Git to run an arbitrary external command whenever it inspects the working tree. An attacker who controls a repository, even one nested in an unprotected subfolder, could plant that setting and wait for the assistant's background Git calls to trigger it, achieving code execution with no shell command from the model and no security warning to the user.

Anthropic first heard about the issue in Claude Code on July 13, according to the disclosure timeline, and shipped a partial fix in version 2.1.223 on August 6 after Accomplish found additional vulnerable code paths. A more complete remediation followed on August 26 in version 2.1.247, which Anthropic described as stripping the dangerous setting from every Git command the harness runs. Cursor's parallel bug moved faster once reported: Accomplish demonstrated a working exploit on July 27, and Anysphere, the company behind Cursor, shipped a patched build on August 4 that sets four Git environment variables on every process it spawns, an approach Hiltch's write-up calls "the right approach" because it closes the class of bug rather than one instance of it.

Not an Isolated Bug

The pattern is not confined to Anthropic and Cursor. Accomplish disclosed a separate, more severe escape in Anthropic's Claude Cowork, a product that lets Claude operate autonomously inside a Linux virtual machine with a folder shared from the user's Mac, in a report posted in July. That chain combined Linux namespace tricks with a kernel memory-corruption bug tracked as CVE-2026-46331 to break out of the VM entirely and reach the host's SSH keys and cloud credentials; Anthropic closed the report as "informative" rather than a qualifying security vulnerability, and has since made Cowork default to cloud-based execution instead of a local VM.

Nor is Accomplish the only outside group finding these gaps. In July, researchers affiliated with the Cloud Security Alliance published a research note describing a related trust-boundary flaw in Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Google's Antigravity tool, in which files an agent writes inside its own sandbox are later read by trusted software running outside it. And in early September, a separate group calling itself Manifold Security documented what it named "GitSpawn," the same core.fsmonitor technique turning up in Codex, Claude Code and four open-source coding agents, including Goose and Qwen Code, each requiring its own vendor-specific patch.

Enterprises that have adopted these tools for day-to-day software development are the ones directly exposed, since the attack requires only that a developer point an agent at a repository the developer does not fully control, a common occurrence when reviewing pull requests, cloning open-source dependencies or evaluating a contractor's code. Because the exploit runs during routine background indexing rather than a command the model or user knowingly issues, standard code-review habits do not prevent it. Claude Code, Cursor and Codex CLI have each become default tools inside software teams over the past year specifically because they can act with less manual approval than earlier chat-based assistants, which is the same design choice that widened the gap the researchers exploited: the more a tool is trusted to run unattended, the more consequential a gap in its sandbox becomes.

Vendors Move at Different Speeds

OpenAI told Upstarts Media, which first reported on Accomplish's broader findings, that it had addressed two issues Accomplish reported in August and was "continually strengthening" its sandboxes. Hiltch was more pointed about the industry's overall posture. "There's a lot of talk about security now," he told the outlet. "It doesn't really reflect in how they actually build products." He and co-founder Amit Avner argued that the companies building the underlying AI models ought to be catching this class of bug in their own tools before outside researchers do, adding that "organizations need to be very wary" of treating agent sandboxes as a solved problem.

What Comes Next

Anthropic's own public change log for Claude Code shows a steady cadence of permission and sandbox hardening through August, including fixes for commands that could hide themselves from approval prompts, suggesting the company is treating the reports as part of a broader security push rather than a single patch. Accomplish has said it plans to continue publishing individual technical write-ups as it works through further findings across other agents, and has urged vendors toward architectural fixes, such as denying Git hooks by default and refusing to run any subprocess outside the sandbox, rather than patching each newly discovered variant as it surfaces. Whether that advice is adopted broadly may determine how many more "Beltdown"-style reports follow in the coming months.