EN PT-BR
← Voltar ao feed
medium technology

Bishop Fox researcher extracts Claude sandbox control binary and JWTs, bypasses local-connection block

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 05:21 · coletado há 2 dias

A Bishop Fox researcher probing Anthropic's Claude sandbox coaxed the model into disclosing internal environment details, including a gVisor container layout and a Rust-based PID 1 control daemon named /process_api. Using Claude's conversation file-download API with an absolute path, the researcher retrieved the internal binary, and a memory dump of PID 1 exposed fragments of JSON Web Tokens, including Anthropic-issued EdDSA tokens and Google Cloud service-account ID tokens that were reconstructed and validated against Google's public OAuth keys. The daemon's --block-local-connections protection was bypassed by abusing retained CAP_NET_ADMIN/CAP_NET_RAW capabilities to add a virtual interface and connect from a different source address, yielding an HTTP 101 WebSocket upgrade at /mount_root. No host compromise was achieved: mount attempts failed and the recovered tokens were not further exploited. Anthropic rejected the submissions, stating its security boundaries lie outside the untrusted sandbox.

Detalhes técnicos

  • Information disclosure via LLM prompt: Claude described container runtime, mounts, networking and the /process_api control daemon.
  • Arbitrary file download: conversation file-download API honored absolute filesystem paths outside user-facing directories.
  • Credential exposure: PID 1 memory export leaked partial JWTs; a custom script reconstructed EdDSA and Google service-account ID tokens, accepted by Google's tokeninfo endpoint.
  • Local-origin bypass: excess network capabilities allowed source-address spoofing via a virtual interface, defeating --block-local-connections and reaching the orchestrator WebSocket.

Remediação

The researcher recommends restricting access to infrastructure-process memory, limiting file downloads to approved directories, dropping unnecessary network capabilities (CAP_NET_ADMIN, CAP_NET_RAW) from sandboxes, and hardening local-origin checks beyond source-address inspection.

Linha do tempo

  1. gbhackers.com ↗ · pub. 30/10/2026 05:21 · coletado 30/10 06:00 primeiro registro

    Bishop Fox researcher extracts Claude sandbox control binary and JWTs, bypasses local-connection block

    ler a análise desta fonte

    A Bishop Fox researcher probing Anthropic's Claude sandbox coaxed the model into disclosing internal environment details, including a gVisor container layout and a Rust-based PID 1 control daemon named /process_api. Using Claude's conversation file-download API with an absolute path, the researcher retrieved the internal binary, and a memory dump of PID 1 exposed fragments of JSON Web Tokens, including Anthropic-issued EdDSA tokens and Google Cloud service-account ID tokens that were reconstructed and validated against Google's public OAuth keys. The daemon's --block-local-connections protection was bypassed by abusing retained CAP_NET_ADMIN/CAP_NET_RAW capabilities to add a virtual interface and connect from a different source address, yielding an HTTP 101 WebSocket upgrade at /mount_root. No host compromise was achieved: mount attempts failed and the recovered tokens were not further exploited. Anthropic rejected the submissions, stating its security boundaries lie outside the untrusted sandbox.

    Technical Details

    • Information disclosure via LLM prompt: Claude described container runtime, mounts, networking and the /process_api control daemon.
    • Arbitrary file download: conversation file-download API honored absolute filesystem paths outside user-facing directories.
    • Credential exposure: PID 1 memory export leaked partial JWTs; a custom script reconstructed EdDSA and Google service-account ID tokens, accepted by Google's tokeninfo endpoint.
    • Local-origin bypass: excess network capabilities allowed source-address spoofing via a virtual interface, defeating --block-local-connections and reaching the orchestrator WebSocket.

    Remediation

    The researcher recommends restricting access to infrastructure-process memory, limiting file downloads to approved directories, dropping unnecessary network capabilities (CAP_NET_ADMIN, CAP_NET_RAW) from sandboxes, and hardening local-origin checks beyond source-address inspection.