Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-55607: Claude Code sandbox escape via git worktree path confusion

AIR-2026-0140 AIR record · 2026-06-anthropic-claude-code-worktree-sandbox-escape
Open in dashboard About
From the supporting source
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Executiongithub.com
The record
Disclosed
2026-06-25
Vendor
Anthropic
Product
Claude Code (@anthropic-ai/claude-code)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the agent created worktrees that escaped the sandbox
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Prompt injection in cloned repository
Impact type
Sandbox escape, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Code npm >= 2.1.38 < 2.1.163 running the seatbelt sandbox against an untrusted repository
Capability abused
git_operationsfile_writesymlink_creationshell_execution
Defense & remediation
Recorded defense
macOS seatbelt sandbox restricting writes to the workspace
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
@anthropic-ai/claude-code 2.1.163
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI05 Unexpected Code Execution (RCE)CVE-2026-55607sandbox_escapesymlink_attackpath_confusionindirect_prompt_injectioncoding_agent
Curator notes
GHSA-7835-87q9-rgvv, CVSS 7.7 High, published 2026-06-25. Worktrees could be created with names like '.git' and navigated outside the sandbox; combined with symlinks and git fsmonitor execution this let the agent write ~/.zshenv and get unsandboxed execution. Exploitation required the user to clone a repo carrying prompt-injection material and run Claude Code on it. Related but distinct: CVE-2026-39861 (symlink sandbox escape, fixed in 2.1.64) and CVE-2025-66479 (sandbox-runtime network isolation).
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-55607: Claude Code sandbox escape via git worktree path confusion". AIR, AIR-2026-0140. https://agentincident.vercel.app/i/AIR-2026-0140/ (accessed 2026-10-19).