CVE-2025-66479: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66479 is a network sandbox escape vulnerability in Anthropic's @anthropic-ai/sandbox-runtime npm package (also known as the Anthropic Sandbox Runtime / srt), a lightweight sandboxing tool used by Claude Code to enforce filesystem and network restrictions on AI agent processes. The flaw causes the network sandbox to be completely unenforced when the sandbox policy configures an empty allowedDomains list — a configuration that is explicitly documented to mean "block all network access." All versions prior to 0.0.16 are affected. It was reported by GitHub user bendrucker, disclosed and patched on December 4, 2025, and carries a CVSS v4 base score of 1.8 (Low) (Github Advisory, GHSA Advisory).

The root cause is a Protection Mechanism Failure (CWE-693) in the sandbox's network restriction logic within sandbox-manager.ts. Prior to the fix, the code determined whether a network proxy was needed by checking allowedDomains.length > 0, and then used that same needsNetworkProxy flag as the needsNetworkRestriction flag passed to the platform-specific sandbox wrappers. Consequently, when allowedDomains was an empty array (meaning "block all"), the code concluded no network restriction was needed and skipped the --unshare-net bubblewrap argument on Linux (and the equivalent macOS Seatbelt profile restriction), leaving the sandboxed process with full, unrestricted network access. The fix in commit bea2930 separates the two concerns: needsNetworkRestriction is now set whenever any network.allowedDomains key is present in the config (even if empty), while needsNetworkProxy is only true when there are domains to filter through the proxy (Patch Commit, Github Advisory).

Sandboxed code running under a policy with an empty allowedDomains list — intended to have zero network access — could instead make arbitrary outbound network requests to any host on the internet. In the context of Claude Code and AI agent workflows, this could enable a malicious or compromised sandboxed process (e.g., an MCP server or an AI-generated bash command) to exfiltrate sensitive data such as source code, credentials, SSH keys, or environment variables to attacker-controlled infrastructure. Integrity and availability of the vulnerable system are not directly impacted, but the confidentiality breach could be significant depending on what data the sandboxed process has access to (Github Advisory, SecurityWeek).

No public exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.067% (21st percentile), indicating a low near-term exploitation probability (Github Advisory). Exploitation requires high privileges (the attacker must control code executing inside the sandbox) and specific deployment conditions (the sandbox policy must have allowedDomains defined but empty). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Notably, a researcher published a detailed write-up demonstrating a related network allowlist bypass and data exfiltration scenario in Claude Code's sandbox, highlighting the real-world risk class even if this specific CVE was not weaponized (Researcher Blog).

1. Identify a vulnerable deployment: Confirm the target is running @anthropic-ai/sandbox-runtime version < 0.0.16 with a sandbox policy that includes network.allowedDomains: [] (empty array), which is the configuration intended to block all network access.
2. Gain code execution inside the sandbox: The attacker must control code that runs within the sandbox — for example, by supplying a malicious MCP server, a crafted project file that Claude Code executes, or through prompt injection causing Claude Code to run attacker-supplied commands.
3. Initiate outbound network requests: Because the network namespace isolation (--unshare-net on Linux, Seatbelt profile on macOS) is never applied, the sandboxed process can make direct outbound TCP connections. Use standard tools available in the environment (e.g., curl, wget, python, node) to connect to an attacker-controlled server.
4. Exfiltrate sensitive data: Read accessible files (source code, .env files, credentials, API keys) and transmit them over the unrestricted network connection to an external endpoint, bypassing the intended "no network" policy (Github Advisory, Researcher Blog).

• Network: Unexpected outbound TCP connections originating from sandboxed processes (e.g., bwrap-wrapped processes on Linux or sandbox-exec-wrapped processes on macOS) to external IP addresses or domains not in any allowlist; DNS queries from the sandbox host for external domains when the policy should block all network access.
• Process: Child processes of the srt or bwrap wrapper (e.g., curl, wget, python, node, bash) making network calls when the sandbox policy has allowedDomains: []; absence of network namespace isolation (verifiable via ip netns or /proc/<pid>/net/ inspection on Linux).
• Logs: On Linux, absence of --unshare-net in the bubblewrap command arguments for sandboxed processes when network restriction was expected; on macOS, Seatbelt profile logs not showing network denial entries for processes that should have no network access (log stream --predicate 'process == "sandbox-exec"').
• File System: Unexpected temporary files or scripts in /tmp or the working directory that appear to stage data for exfiltration.

Upgrade the @anthropic-ai/sandbox-runtime npm package to version 0.0.16 or later, which correctly enforces network namespace isolation even when allowedDomains is an empty array (Github Advisory, Patch Commit). As a temporary workaround for users who cannot immediately upgrade, avoid relying on an empty allowedDomains list for network blocking; instead, omit the network configuration key entirely or supplement with OS-level firewall rules (e.g., iptables on Linux) to block outbound traffic from sandboxed processes. Users of Claude Code should ensure their Claude Code installation is updated, as it bundles this runtime.

SecurityWeek reported that Anthropic "silently patched" the vulnerability without a prominent public announcement, drawing attention to the practice of quiet security fixes in AI tooling (SecurityWeek). A researcher published a detailed blog post titled "Second Time, Same Sandbox" documenting a related network allowlist bypass and SOCKS5 credential exfiltration scenario, framing the issue as a recurring pattern in Claude Code's sandbox design (Researcher Blog). Community discussion on Reddit's r/pwnhub highlighted the broader concern about AI agent sandbox security, with commentary noting that even Claude itself acknowledged the hole was "real and dangerous" (Reddit, ThreatsHub). Coverage from CyberSecurityNews and GBHackers emphasized the risk of credential and source code exposure in AI-assisted development workflows (CyberSecurityNews, GBHackers).