Claude Code sandbox escape via symlink-following in unsandboxed helper

CVE-2026-39861 is a sandbox-escape flaw in Anthropic’s Claude Code agentic coding tool, fixed in version 2.1.64. The NVD record describes it as a symlink-following bug that split its primitive across two processes — neither one of which could reach outside the workspace on its own, but their combination could.

Per NVD’s summary, the sandboxed side of Claude Code did not block sandboxed processes from creating symlinks pointing to locations outside the workspace directory. When the unsandboxed side of the app later wrote to a path that transited one of those symlinks, it followed the link and wrote to the target location outside the workspace without prompting for confirmation. Chained together, that primitive was enough to write arbitrary files, up to and including paths that could lead to code execution outside the sandbox.

What actually needs the fix

• Standard auto-update installs: nothing to do. Per Anthropic’s advisory text in the NVD entry, users on Claude Code’s default auto-update path received 2.1.64 automatically.
• Manual-update installs: update to 2.1.64 or later. That’s the whole action item — there’s no configuration mitigation, no --flag you can pass on the old build to close it. If your organization pins Claude Code versions for reproducibility or air-gap reasons, this is the release you need to pull forward past.

To confirm what you’re running, claude --version on the CLI. Anything below 2.1.64 is affected.

How the primitive is triggered

NVD’s advisory is explicit that reliably exploiting this required an attacker to get untrusted content into a Claude Code context window — the practical delivery vector is prompt injection through a repository, document, or tool output the agent was asked to read, which is then used to cue the sandboxed execution step into planting the symlink. That threat model is worth flagging out loud: if you’re running Claude Code against untrusted repositories, the same class of exposure that has been showing up across autonomous-coding-agent research for months now applies here, and it’s exactly why the CVSS lands at 10.0.

For the broader research context on what “review-then-execute” agents get wrong when they’re pointed at hostile input, see AI Now Institute’s Friendly Fire brief, which references this CVE as a prior example of an issue Anthropic did treat as a security bug and patched through its formal disclosure channel.

Sources

• NVD entry for CVE-2026-39861
• Anthropic — Claude Code documentation
• AI Now Institute — Friendly Fire brief (references this CVE in Section on prior disclosures)