Your Coding Agent Sandbox Probably Leaks. Here Is Where.

An agent sandbox escape is rarely a dramatic exploit. It is usually a boring mismatch: the isolation layer believes it is looking at one path, one repository, or one command string, and the operating system underneath resolves something else. Four of Claude Code’s last five releases — 2.1.216 through 2.1.219, shipped between July 20 and July 24, 2026 — each closed exactly that kind of mismatch, and each closed a different one.

That cadence is the story. Not one bug, but four unrelated primitives in a single week, on a product with a mature sandbox and a public changelog. If a well-resourced vendor is still finding one boundary gap per release, the working assumption for every other agent in your stack should be that its boundaries have not been tested that hard yet.

This guide maps the four fixes against the exact primitive each one closed, examines the trade-off buried in 2.1.218 — where three dangerous-command checks moved out of permission dialogs and into the auto-mode classifier — and sets that patchable class against GuardFall, the command-filter bypass research that carries no CVE because there is nothing to version-bump. It ends with a re-test checklist keyed to minor versions, which is the cadence the evidence actually supports.

The Claude Code changelog publishes each release as a list of prose bullets. Read one version at a time, each entry looks routine. Laid out as a cross-version matrix against the question “which isolation surface did this touch?”, the shape changes: 2.1.216 on July 20, 2.1.217 on July 21, 2.1.218 on July 22 and 2.1.219 on July 24 all modified how the sandbox draws its perimeter. 2.1.220 on July 25 was the first release in the run that did not.

Four of the five releases in that window carry an isolation-boundary entry. The four that do span July 20 to July 24; the fifth, on July 25, is the outlier. Nothing here suggests the product is unusually weak — the opposite reading is better supported. A vendor shipping documented boundary fixes at this rate is a vendor actively looking. The uncomfortable corollary is what it implies about agents whose changelogs are silent on the subject.

2.1.219 also shipped the day Claude Code made Opus 5 its default Opus model, which we cover separately in our Opus 5 launch and pricing breakdown. The subagent concurrency cap and budget-cap enforcement introduced alongside these fixes get their own treatment in the subagent depth and budget caps guide.

Worktree isolation is an attractive sandbox design: give each subagent its own git worktree, and a bad edit is contained to a directory you can throw away. It works right up until something in the environment quietly re-points the agent at the real checkout. Two consecutive releases closed three separate ways that could happen.

Read together, the three share a single failure mode: the sandbox enforces a perimeter around a path it resolved once, while everything inside the perimeter is free to name a different path later. Symlinks do it at the filesystem layer, git flags do it at the tool layer, and stale worktrees do it at the session-selection layer. Any isolation design that resolves a boundary early and trusts it thereafter has this shape somewhere.

The sharpest change in the whole run is one line in 2.1.218. Checks for dangerous rm invocations, backgrounded commands ending in &, and suspicious Windows paths no longer open a permission dialog. The auto-mode classifier adjudicates them instead.

The case for the change is real and should not be waved away. A string match that fires on every rm -rf ./dist trains people to approve without reading, and a guardrail that is reflexively dismissed is not a guardrail. A classifier can weigh context — what the command is deleting, whether the path is inside the workspace, what the session was asked to do — in a way a regular expression never can, and it removes an interruption that was producing very little signal.

The cost is equally real. A deterministic check has a property a model does not: you can enumerate exactly what it catches, write a test for it, and get the same answer on every run. Moving three checks behind a classifier converts a guarantee into a judgement, and judgement is version-dependent in a way string matching is not. The same command in the same repository can be adjudicated differently after a model swap that has nothing to do with your configuration.

The practical response is not to argue the trade-off. It is to stop treating the dialog as a control you can cite, and to start measuring the classifier the way you would measure any other probabilistic component — with a corpus of destructive commands you replay after each minor bump and a recorded allow-or-deny outcome for each one. That is the difference between a control you have tested and a control you have assumed.

Disclosed on June 30, 2026 by Adversa AI, GuardFall is a class of shell-injection bypasses against AI coding and computer-use agents. The mechanism is almost insultingly old. An agent validates a command as plain text against a blocklist. Bash then rewrites and expands that same text — quote removal, $IFS expansion, command substitution, base64 piping, destructive argv flags — before executing it. The guard inspects one string; the shell runs another.

Adversa AI tested eleven open-source agents: Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent and Continue. Ten failed. The headline figure has been reported across several security outlets, and Adversa AI published the agent-by-agent breakdown behind it.

No CVE was assigned to GuardFall. That is not a downgrade — it is the finding. A CVE presumes a defect in a specific artefact at a specific version, which implies a version where the defect is gone. GuardFall describes a shared design convention: validate the command string, then hand it to a shell that will rewrite it. Ten independent projects arrived at the same convention because it is the obvious way to build the feature, and the next agent that implements a command allowlist from scratch will very likely arrive there too.

The operational consequence is uncomfortable for anyone whose security posture is built on version pinning. There is no minimum safe version to pin to. The remediation Adversa AI published is configuration and architecture, not upgrades: point the agent process’s $HOME away from SSH keys and cloud credentials, capture multi-line shell scripts for out-of-band review rather than inline approval, audit repository config files such as .aider.conf.yml for execution triggers, disable agent execution on fork pull requests in CI, and turn off auto-execution flags like --auto-exec, --auto-run and yolo. This is the same containment logic behind scoping non-human credentials properly — if the blast radius is small enough, a filter bypass stops being a breach.

Continue was the single agent in the test set that defended, and it did so structurally rather than by having a better blocklist. Its evaluator tokenizes the command, detects variable expansion, recursively evaluates substitutions, checks where pipes terminate, and maintains a disabled-command list on top of all of that. In other words, it does some of the work bash would do before deciding whether the command is safe, rather than pattern-matching the raw text and hoping the two interpretations agree.

None of what follows is new news. All of it was disclosed and fixed before the July window, and it is worth reading precisely because it establishes that the July cluster is a continuation rather than an anomaly.

A worktree sandbox-escape CVE disclosed in June 2026 — rated CVSS 8.8 High by the advisory database carrying it, though the HackerOne triage put it at 7.7, and affecting versions 2.1.38 through 2.1.162 before it was patched in Claude Code 2.1.163 — chained a series of individually unremarkable behaviours. An attacker-controlled repository was laid out as a valid git directory at its root rather than only inside .git. A worktree could be created literally named .git, causing gitdir confusion. Worktree creation followed a symlink planted at .claude/worktrees pointing at $HOME. A routine git status in that worktree then fired a malicious core.fsmonitor hook from the planted config, whose payload overwrote ~/.zshenv — a file zsh sources before the macOS seatbelt sandbox restrictions take effect. The result was unsandboxed execution on every subsequent shell invocation.

The fix in 2.1.163 rejected .git as a valid worktree name, which eliminated the primitive that started the chain. That is a narrow, single-primitive patch — and pointedly it is not the same primitive as either July fix. The June patch closed a naming confusion; 2.1.217 closed symlink canonicalisation for background sessions; 2.1.218 closed git redirection out of a worktree. Three fixes, one nominal surface, three unrelated primitives, roughly six weeks apart. That is direct evidence that closing one worktree escape vector does not close the class.

Two more disclosures fill in the picture. On June 1, 2026, RyotaK of GMO Flatt Security Inc. disclosed a prompt-injection-to-secret- exfiltration flaw in the claude-code-action GitHub Action, rated CVSS v4.0 7.8 and fixed in v1.0.94. The root cause was a permission check that unconditionally trusted any GitHub App actor, regardless of that app’s actual permissions — so an attacker’s own app, installed on their own repository, could open an issue against a target repository and trigger a workflow that processed untrusted input while the “trusted actor” check reported success.

Separately, Microsoft’s Defender Security Research Team reported an earlier Claude Code flaw on April 29, 2026: the Read tool bypassed the Bash sandbox’s environment-variable scrubbing through direct in-process file access, letting an attacker target /proc/self/environ to read the Anthropic API key. It was patched in Claude Code 2.1.128 by unconditionally rejecting reads of a range of /proc/ paths. Again: months old, already fixed, and structurally identical to July’s cluster — one tool inside the sandbox reaching a resource the sandbox thought it had closed off.

Four disclosures, four separate reporters, two vendors’ products. The useful question is not how severe each one is — it is whether a version bump retires it. Sorted that way, the picture separates cleanly, and the separation is the thing to carry into your own security review.

Three of the four rows have a version number in the last column, and for those three the security posture that works is the familiar one: track advisories, upgrade promptly, verify the fixed version is deployed everywhere. The fourth row has no version number and never will, which means no amount of upgrade discipline moves it. That is the distinction almost every internal agent-security policy we see is missing — it treats “are we on a patched version?” as the whole question.

Projecting forward, the structural row is the one that grows. Every new coding agent ships a command allowlist early because users demand it, and the cheapest implementation is string matching against a blocklist. Unless canonicalisation becomes the default expectation the way parameterised SQL queries eventually did, this class will resurface in each new tool that copies the pattern — and it will keep arriving without a CVE to track it. Teams that want early warning should watch the agent-security research feeds, not the advisory databases, because the advisory databases will not carry this category at all. Our analysis of enterprise risk in AI-generated code covers the adjacent question of what unreviewed agent output does once it is merged.

The evidence base for this checklist is the table in section 01: four minor bumps in five days, each changing what the sandbox actually enforces, none of them a major version. Annual penetration testing does not have the resolution to catch that. Neither does a control document written against the behaviour of a version you stopped running three weeks ago.

Run the following after every minor version bump of any agent that has filesystem or shell access. Each item maps to a primitive that has demonstrably changed in production this year.

1. Symlinked working directory. Point a project at a symlinked path, start a background session, and confirm it cannot write outside the canonical root. This is the exact gap 2.1.217 closed.
2. Git redirection out of a worktree. Inside a worktree-isolated subagent, attempt git -C, --git-dir, GIT_DIR and GIT_WORK_TREE against the shared checkout. All four must be refused, not just the one you remember.
3. Stale worktree attachment. Open a worktree session from a directory that does not match the selected project and confirm it does not attach to another project’s leftover worktree.
4. Symlink and hard-link rewind targets. Plant a symlink at a tracked path, run /rewind, and confirm it reports skipped paths rather than following the link.
5. Destructive-command corpus. Since dangerous rm, background & and suspicious Windows paths are adjudicated by the classifier rather than a dialog, replay your own corpus in auto mode and record the allow-or-deny outcome for each entry. Diff it against the previous version’s results.
6. Network egress. Confirm sandbox.network.strictAllowlist is enabled and that a non-allowlisted host is denied without a prompt, rather than prompting a user who will approve it.
7. Fan-out and depth. Check the concurrent-subagent cap and the nesting depth against your intended blast radius. Depth returned to 3 by default in 2.1.219 after being disabled in 2.1.217; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 if you want nesting off.
8. Budget enforcement. Verify that hitting the spend cap halts background subagents, not just foreground work — that was only true from 2.1.216 onwards.
9. Untrusted hooks. Confirm that agent frontmatter hooks loaded from a folder you have not explicitly trusted do not execute.
10. Filesystem isolation toggle. Audit whether anyone has set sandbox.filesystem.disabled, and confirm egress control is still on independently if they have.

One rule governs how you read the results: a release with no isolation entries in its changelog means no news, not proven safety. 2.1.220 introduced nothing on this surface, which tells you the perimeter did not move that day — it tells you nothing about whether the perimeter is correct. Anthropic’s own three-layer scanning security plugin is a useful complement here, and if a boundary does turn out to have been open, the sequence to run is in our agentic-workflow incident response playbook alongside the rollback and checkpoint patterns that determine how much you can actually undo. Teams that want this wired into a real engineering process rather than a document tend to fold it into their platform work — that is the shape of most of our AI transformation engagements, and it sits close to the delivery standards in our web development practice.