A cybersecurity researcher says Anthropic has silently patched a vulnerability that would have allowed an attacker to bypass the Claude Code network sandbox, potentially enabling data exfiltration.
Claude Code’s network sandbox funnels all outbound traffic through a local allowlist proxy, silently blocking any connection to unapproved hosts.
According to vulnerability researcher Aonan Guan, two Claude Code network sandbox bypasses were discovered recently. One of them, tracked as CVE-2025-66479 and discovered by a different researcher, was related to the sandbox interpreting a setting to block all outbound traffic as ‘allow everything’.
This issue was fixed with an update released on November 26, 2025.
The second sandbox bypass vulnerability, discovered by Guan, has been described as a SOCKS5 hostname null-byte injection issue.
