A sandboxed shell process could race the unsandboxed Edit tool pathname check and redirect a validated write outside the workspace. Entry and authority. The agent has access to the Bash sandbox and the Edit operation; a local adversarial process can atomically change a directory symlink. Observed mechanism and consequence. The post-validation rename…
Inspect the ClaimsCase · DiggingBeagle record
Claude Code Edit could write outside the workspace through a macOS symlink race
A sandboxed shell process could race the unsandboxed Edit tool pathname check and redirect a validated write outside the workspace.
Public disclosure: Oct 26, 2026
Scope
The agent has access to the Bash sandbox and the Edit operation; a local adversarial process can atomically change a directory symlink. The post-validation rename caused a file edit to resolve through the new symlink outside the path that had passed the workspace check.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-CLAUDE-EDIT-TOCTOU; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-CLAUDE-EDIT-TOCTOU-01 · CLM-DB233-CLAUDE-EDIT-TOCTOU-02 · Claude Code Edit TOCTOU workspace escape
At a glance
Requires macOS timing and writable target; not evidence of unrestricted host-wide permission or observed production compromise.
Limits and uncertaintyFull account
A sandboxed shell process could race the unsandboxed Edit tool pathname check and redirect a validated write outside the workspace.
Entry and authority. The agent has access to the Bash sandbox and the Edit operation; a local adversarial process can atomically change a directory symlink.
Observed mechanism and consequence. The post-validation rename caused a file edit to resolve through the new symlink outside the path that had passed the workspace check.
Limits and status. Requires macOS timing and writable target; not evidence of unrestricted host-wide permission or observed production compromise.
The macOS Edit tool checked whether a path was within the workspace and later opened it without binding that check to the same underlying directory entry. Attacker-controlled code already running in a sandbox could swap a parent directory for a symlink during the gap, redirecting Edit to a user-writable path outside the workspace. This requires an attacker process with timing and filesystem influence; it is not a direct remote prompt-only write to arbitrary host files.
Mechanism and trust boundary
- 01
Precondition and trust context
The agent has access to the Bash sandbox and the Edit operation; a local adversarial process can atomically change a directory symlink.
- 02
Crossed boundary
The post-validation rename caused a file edit to resolve through the new symlink outside the path that had passed the workspace check.
- 03
Observed limit
Requires macOS timing and writable target; not evidence of unrestricted host-wide permission or observed production compromise.
Timeline
- Oct 26, 2026Event type unspecified
Initial documented finding
Claude Code Edit could write outside the workspace through a macOS symlink race
- Oct 26, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-CLAUDE-EDIT-TOCTOU-01The advisory reports a time-of-check/time-of-use gap in Edit target validation and inode binding on macOS.supported
Basis: reported finding
- supportsClaude Code Edit TOCTOU workspace escapeprimary disclosure
Description and technical preconditions
CLM-DB233-CLAUDE-EDIT-TOCTOU-02The affected package is @anthropic-ai/claude-code below 2.1.251; the patch is 2.1.251.supported
Basis: reported finding
- supportsClaude Code Edit TOCTOU workspace escapeprimary disclosure
Affected and Patched Versions
Controls and mitigations
- Use the patched Claude Code version and bind edit targets to stable file descriptors or inode-checked directories across validation and write.
- Do not run untrusted repository scripts with write access to outside-workspace locations while an agent is editing files.
Unknowns and contradictions
- Requires macOS timing and writable target; not evidence of unrestricted host-wide permission or observed production compromise.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235