Disclosed vulnerability
CVE-2026-39861: Claude Code sandbox escape via symlinks pointing outside the workspace
AIR-2026-0094 AIR record · 2026-04-anthropic-claude-code-symlink-sandbox-escape
From the supporting source
Sandbox escape vulnerability in Anthropic Claude Code allowing arbitrary file writes outside the workspace through symlink manipulation prior to version 2.1.64.sentinelone.com
The record
Disclosed
2026-04-23
Vendor
Anthropic
Product
Claude Code
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the sandboxed agent created symlinks and wrote outside its workspace
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Symlink created by sandboxed process
Impact type
Sandbox escape, Arbitrary file write
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Code prior to 2.1.64
Capability abused
Defense & remediation
Recorded defense
workspace-scoped sandbox
Guardrail kinds
Sandbox isolation, Permission scope
Guardrail outcome
Silent
Fix shipped
Claude Code 2.1.64
Taxonomy & references
Curator notes
CVSS 7.7. The upstream GHSA for this CVE is not published in the GitHub advisory listings; the source of record is SentinelOne's vulnerability database reproducing the CVE record, so this is secondary per the CURATION rule and confidence is medium. Chronologically the first of three Claude Code sandbox issues in the corpus, followed by CVE-2026-55607 (worktree path confusion, 2.1.163) - the same symlink class recurring after a fix.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-39861: Claude Code sandbox escape via symlinks pointing outside the workspace". AIR, AIR-2026-0094. https://agentincident.vercel.app/i/AIR-2026-0094/ (accessed 2026-10-19).