Beltdown: a hostile repo can escape Claude Code's sandbox on macOS
Anthropic took 44 days and dozens of releases to close it; Cursor and Codex patched the same class in about a week. The real fix is isolating the whole agent.
Copy markdown
How a repo breaks out: git fsmonitor and a nested .git
Opening an untrusted project in Claude Code could run commands as your own user — no permission prompt, even with sandbox mode at its strictest. The chain: git's core.fsmonitor executes an arbitrary shell command on any working-tree read, a poisoned .git dropped in a subfolder dodged incomplete Seatbelt rules, and auto-loading a skill fired an unhardened `git ls-files` outside the sandbox.
The trust gap: 44 days at Anthropic, a week elsewhere
Accomplish reported Beltdown on July 13; the complete fix didn't land until Aug 26 — about 44 days across roughly 30 releases, because each patch sealed one route and left another open. Cursor and OpenAI shipped fixes for the same class of escape in around a week. If you pin versions, treat Claude Code's late-August builds as the safe floor on macOS.
It's a class, not one bug: agent writes, host runs
Pillar Security mapped the whole pattern earlier: the agent obeys every sandbox rule and simply writes a file that a trusted tool outside the box later executes. Filed CVEs include Cursor's workspace-controlled .claude hook config (CVE-2026-48124, fixed in v3.0.0) and Codex CLI trusting `git show` by name without checking its arguments (patched in v0.95.0, high-severity bounty paid).
Also swept up: Gemini CLI, Antigravity, a Docker-socket hole
The same research flagged privileged Docker-socket access granting unsandboxed execution across Cursor, Codex, and Gemini CLI (now fixed), plus two Secure Mode bypasses in Google Antigravity — a macOS Seatbelt denylist gap and a .vscode task-config escape — that Google downgraded to 'other valid' issues. Update whichever agent you run before opening code you didn't write.
What actually holds: run the agent in a throwaway VM
The disclosers' own setup is the takeaway: don't hand the built-in sandbox untrusted code. Put the whole agent in a disposable VM, keep credentials and SSH keys out of it, and route network egress through a proxy you control. For any 'review this stranger's repo' or CI flow, assume the agent's file output is hostile to your host tools.