Anthropic’s sandbox isolation faced a novel stress test when researcher Bishop Fox utilized Claude’s own verbose self-awareness to extract internal infrastructure secrets. By prompting the model to describe its execution environment, the researcher obtained specific filesystem paths, network configurations, and process details that guided a deeper investigation into the container's internals. The result was the retrieval of Anthropic’s proprietary process_api binary and the reconstruction of cryptographically valid Google Cloud Platform service account tokens directly from process memory.

The Self-Disclosing Sandbox

The investigation began with a simple query to Claude regarding its sandbox environment. The model, running on an Ubuntu 24.04.4 LTS instance within a gVisor container, provided a detailed breakdown of its runtime. It identified the kernel as runsc, listed mounted read-only skills directories, and crucially, pointed to /process_api as the PID 1 process. Claude described this binary as a Rust-compiled, statically linked ELF file responsible for managing process lifecycles, FUSE filesystem mounts, and host communication via WebSockets. This level of introspection provided the concrete infrastructure components needed to move beyond theoretical security questions to practical exploitation.

Binary Extraction and Memory Reconstruction

Armed with the path /process_api, the researcher discovered that Claude’s file-download API did not restrict requests to user-facing directories like /mnt/user-data. By supplying the absolute path, they successfully downloaded the 3.1MB internal binary. The investigation then pivoted to process memory. Through a carefully crafted prompt asking for a raw dump of PID 1's memory, Claude returned a file containing fragments of JSON Web Tokens (JWTs). Some bytes were missing due to memory volatility, but a custom Python script utilizing brute-force techniques against Google’s public OAuth keys successfully reconstructed two types of tokens: EdDSA-signed tokens for Anthropic infrastructure and RS256-signed Google service account ID tokens. Validation against Google’s OAuth 2 token-info API confirmed these recovered tokens were cryptographically valid and accepted.

Bypassing Local Connection Restrictions

The process_api service was configured with the --block-local-connections flag, resetting requests from 127.0.0.1. However, the sandbox container retained CAP_NET_ADMIN and CAP_NET_RAW capabilities. When direct attempts to create a tunnel interface were blocked by Claude’s safeguards, a subtle hint regarding IP_FREEBIND prompted the model to configure a virtual network interface. This allowed the researcher to establish a connection from a non-loopback source IP, successfully bypassing the local restriction and achieving a 101 Switching Protocols response from the internal WebSocket service. This demonstrated that the model’s helpfulness in configuring the environment inadvertently facilitated the bypass of its own network controls.

Anthropic’s Threat Model Response

The researcher submitted six observations, including the memory extraction and binary download, through Anthropic’s bug bounty program. Anthropic’s response was definitive: none of the sandbox-related observations were considered security issues. The company stated that its threat model places security boundaries outside the context of the untrusted sandbox, meaning the sandboxed model’s ability to read its own infrastructure details is an accepted product capability rather than a vulnerability. Two separate issues regarding Claude Enterprise controls were also reported, with one marked as informational and the other as a duplicate, further highlighting the gap between client-side UI restrictions and server-side API enforcement.

Key Takeaways

  • Claude’s verbose self-description exposed internal paths, process IDs, and network configurations that guided the security investigation.
  • The file-download API accepted absolute paths, allowing the extraction of the proprietary process_api binary from the sandbox.
  • Valid Google Cloud service account tokens were reconstructed from process memory fragments, demonstrating the persistence of sensitive credentials in the sandbox environment.
  • Network capabilities like CAP_NET_ADMIN allowed for the creation of virtual interfaces, bypassing local connection restrictions on internal services.
  • Anthropic maintains that sandbox isolation is not a security boundary against the model itself, classifying these findings as intended behavior rather than vulnerabilities.

The Bottom Line

While Anthropic dismisses these findings as outside their threat model, the ease with which Claude volunteered its own secrets and facilitated its own exploitation raises questions about defense-in-depth in LLM sandboxes.