{
 "public_id": "AIR-2026-0094",
 "incident_id": "2026-04-anthropic-claude-code-symlink-sandbox-escape",
 "date_disclosed": "2026-04-23",
 "date_occurred": null,
 "title": "CVE-2026-39861: Claude Code sandbox escape via symlinks pointing outside the workspace",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "symlink_created_by_sandboxed_process",
 "agent_capability_abused": [
  "file_write",
  "symlink_creation"
 ],
 "target_product": "Claude Code",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "sandbox_escape",
  "arbitrary_file_write"
 ],
 "blast_radius": "Claude Code prior to 2.1.64",
 "cve": [
  "CVE-2026-39861"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_escape",
   "symlink_attack",
   "coding_agent"
  ]
 },
 "defense_present": "workspace-scoped sandbox",
 "defense_bypassed": true,
 "fix_shipped": "Claude Code 2.1.64",
 "primary_sources": [
  "https://www.sentinelone.com/vulnerability-database/cve-2026-39861/"
 ],
 "verified_quote": "Sandbox escape vulnerability in Anthropic Claude Code allowing arbitrary file writes outside the workspace through symlink manipulation prior to version 2.1.64.",
 "confidence": "medium",
 "notes": "CVSS 7.7. The upstream GHSA for this CVE is not published in the GitHub advisory listings; the source of record is SentinelOne's vulnerability database reproducing the CVE record, so this is secondary per the CURATION rule and confidence is medium. Chronologically the first of three Claude Code sandbox issues in the corpus, followed by CVE-2026-55607 (worktree path confusion, 2.1.163) - the same symlink class recurring after a fix.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the sandboxed agent created symlinks and wrote outside its workspace",
 "vector_family": "other",
 "vector_detail": "symlink_created_by_sandboxed_process",
 "guardrail_kind": [
  "sandbox_isolation",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-39861"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}