Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

1. Executive summary

A sandbox escape vulnerability in Anthropic's Claude Code (CVE-2026-55607) allows an attacker to achieve unsandboxed code execution on a developer's machine via git worktree path confusion and symlink manipulation. The attack chain requires the user to clone a malicious repository containing prompt injection content and run Claude Code against it; the attacker can then overwrite files in the user's home directory (e.g., .zshenv) to escape macOS seatbelt sandbox restrictions. No verified CVSS score, severity rating, or CISA-KEV exploitation state was available in the reference data for this CVE at time of writing. EMEA financial services clients whose developers or CI/CD pipelines use Claude Code against untrusted repositories are exposed to developer workstation compromise and potential credential theft.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 24: digital operational resilience testing — general requirements	The vulnerability is exploitable when Claude Code processes untrusted repository content, requiring clients to test AI-assisted development tooling against adversarial inputs before deployment in production workflows.	Clients must include prompt-injection and sandbox-escape scenarios in their ICT resilience testing programmes for AI coding tools.
NIS2 Art. 21(2)(d): supply chain security measures	The attack vector is a malicious upstream repository processed by a third-party AI tool (Claude Code), directly implicating supply-chain security for development environments.	Clients must assess and mitigate the risk of processing untrusted third-party code repositories through AI agents with filesystem access.

3. Technical analysis & attack chain

Confirmed attack chain (from the GitHub advisory, GHSA-7835-87q9-rgvv)

Malicious repository preparation: An attacker creates a repository containing prompt injection content designed to be processed by Claude Code.
User clones and runs Claude Code: The victim clones the malicious repository and runs Claude Code against it. This is the required precondition — exploitation is not drive-by.
Worktree creation named .git: Claude Code's worktree handling permitted creation of git worktrees named .git, enabling git directory confusion attacks.
Sandbox context escape via worktree navigation: The attacker leverages the worktree handling to navigate to worktrees outside the sandbox context.
Symlink manipulation: The attacker exploits symlink manipulation during worktree operations to redirect file writes.
git fsmonitor execution: Git fsmonitor execution during worktree operations is abused as part of the exploitation chain.
Home directory file overwrite: The chain overwrites files in the user's home directory — specifically .zshenv is cited — achieving persistence outside the sandbox.
Unsandboxed code execution: The overwritten .zshenv executes on shell startup, running attacker-controlled code outside of seatbelt sandbox restrictions.

Microsoft Threat Intelligence separately documented that Claude Code's GitHub Action could expose CI/CD workflow secrets when processing untrusted GitHub content (issue bodies, PR descriptions, comments). The Read tool was not subject to the same sandboxing model as Bash subprocess execution, allowing access to /proc/self/environ and extraction of ANTHROPIC_API_KEY and other runner credentials. Anthropic mitigated this in Claude Code version 2.1.128 by blocking access to sensitive /proc files. This is a distinct but related trust-boundary failure in the same tool ecosystem; attribution of the prompt-injection activity described by Microsoft is unconfirmed (no MITRE actor profile resolved).

Key technical specifics

Sandbox technology: macOS seatbelt sandbox (Claude Code's sandboxing mechanism on macOS).
Exploited component: Git worktree handling within Claude Code.
Target file: ~/.zshenv (shell environment file, executes on every interactive/non-interactive zsh invocation).
Exploitation mechanism: Git directory confusion via .git-named worktree + symlink manipulation + git fsmonitor execution.
Precondition: User must clone a malicious repository and run Claude Code against it.
Patched versions: Not explicitly stated beyond "latest version"; users on standard auto-update have received the fix.

4. Mitigation & containment

P1 — Within 24 hours

Update Claude Code to the latest version on all developer workstations and CI/CD runners. Users on standard auto-update have already received the fix; verify by checking the installed version. For manual-update installations, run the update immediately.
If Claude Code is used in GitHub Actions CI/CD workflows, ensure the version is ≥ 2.1.128 (which blocks /proc file access via the Read tool per Microsoft's disclosure).
Audit GitHub Actions workflows that invoke Claude Code Action against public/untrusted repositories. Disable any workflow that processes untrusted issue/PR content with Claude Code until the patched version is confirmed deployed.

P2 — Within 72 hours

Restrict Claude Code from running against untrusted or newly cloned repositories. Implement a policy requiring repository allowlisting before Claude Code invocation.
Review developer workstations for signs of compromise: check ~/.zshenv, ~/.bashrc, ~/.bash_profile, ~/.profile for unexpected modifications or injected commands.
If macOS seatbelt sandbox profiles are customised for Claude Code, verify the sandbox profile denies writes to the home directory outside the designated workspace.

P3 — Within 7 days

Implement EDR monitoring rules for Claude Code processes writing to ~/.zshenv or other shell startup files (see §6).
For CI/CD pipelines: ensure secrets are not exposed to runner environments when AI agents process untrusted content. Use GitHub Actions secrets masking and minimise the secret scope available to any job invoking Claude Code.
Establish a process to track and rapidly deploy Claude Code security updates, treating the tool as a tier-2 dependency requiring patch SLAs.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are present in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
Claude Code process creating git worktrees named `.git`	Process monitoring / filesystem audit logs (macOS Endpoint Security framework)	High — confirmed in advisory
Symlink creation within Claude Code workspace directories	Filesystem audit logs	High — confirmed in advisory
Writes to `~/.zshenv` by Claude Code or child processes	File integrity monitoring / EDR file-write events	High — confirmed in advisory
`git fsmonitor` execution spawned by Claude Code	Process monitoring (parent-child process telemetry)	Medium — confirmed as part of attack chain
Claude Code `Read` tool accessing `/proc/self/environ`	Process file-access audit logs (CI/CD runners)	Medium — confirmed in Microsoft research for CI/CD variant

6. Detection

rule Claude_Code_Worktree_Sandbox_Escape_AT_2026_07_24 {
    meta:
        author = "Adverse Trace"
        date = "2026-07-24"
        reference = "https://github.com/advisories/GHSA-7835-87q9-rgvv"
        description = "Detects files indicative of Claude Code git worktree sandbox escape targeting .zshenv"
    strings:
        $zshenv_path = ".zshenv" ascii
        $worktree_git = "worktree" ascii
        $fsmonitor = "fsmonitor" ascii
    condition:
        $zshenv_path and ($worktree_git or $fsmonitor)
}

title: Claude Code Process Writes to Shell Startup File
id: 7a8c2d1e-4b5f-4a6e-9c8d-1a2b3c4d5e6f
status: experimental
description: Detects Claude Code or child processes writing to ~/.zshenv, indicating potential sandbox escape via git worktree path confusion (CVE-2026-55607)
author: Adverse Trace
date: 2026/07/24
references:

    - https://github.com/advisories/GHSA-7835-87q9-rgvv
logsource:
    product: macos
    category: file_event
detection:
    selection:
        Image|contains:

            - "claude"
            - "node"
        TargetFilename|endswith:

            - "/.zshenv"
            - "/.bashrc"
            - "/.bash_profile"
            - "/.profile"
    condition: selection
falsepositives:

    - Legitimate shell configuration updates by the user
level: high

title: Git Worktree Named .git Created by Claude Code
id: 8b9d3e2f-5c6a-4b7f-8d9e-2b3c4d5e6f7a
status: experimental
description: Detects creation of a git worktree named .git, a key step in the Claude Code sandbox escape (CVE-2026-55607)
author: Adverse Trace
date: 2026/07/24
references:

    - https://github.com/advisories/GHSA-7835-87q9-rgvv
logsource:
    product: macos
    category: process_creation
detection:
    selection_worktree:
        Image|endswith: "/git"
        CommandLine|contains|all:

            - "worktree"
            - "add"
            - ".git"
    filter_legitimate:
        CommandLine|contains:

            - "worktree add .git/"
    condition: selection_worktree and not filter_legitimate
falsepositives:

    - Unlikely; naming a worktree .git is not a standard workflow
level: critical

7. Sources

GitHub Advisory Database — GHSA-7835-87q9-rgvv: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution — https://github.com/advisories/GHSA-7835-87q9-rgvv — 2026-07-24
Microsoft Threat Intelligence — Securing CI/CD in an agentic world: Claude Code GitHub Action case — https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/ — 2026-06-05
SecurityWeek — Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines — https://www.securityweek.com/new-attack-abuses-claude-code-and-harmless-looking-repositories-to-hijack-developer-machines/ — 2026 (exact date not specified)

8. Adverse Trace position

This is a credible sandbox escape in a widely adopted AI coding assistant, with a confirmed attack chain that requires only that a developer clones a malicious repository and runs Claude Code against it — a low-barrier precondition in modern development workflows. No CVSS score, severity rating, or CISA-KEV exploitation state was available in the verified reference data; we assess the practical risk as high for clients whose developers use Claude Code against untrusted repositories or whose CI/CD pipelines expose secrets to Claude Code Action on public repositories. The fix is deployed via auto-update, which limits the window of exposure for standard installations, but manual-update users and CI/CD runners require explicit verification. The related Microsoft findings on /proc/self/environ access via the Read tool are single-sourced (Microsoft Threat Intelligence blog) and describe a distinct but adjacent trust-boundary failure; clients should verify their Claude Code version independently. We will monitor for any proof-of-concept code, additional CVEs in the Claude Code toolchain, and any confirmed in-the-wild exploitation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.