The report
A file path can pass a workspace check and then point somewhere else by the time a tool opens it. A Claude Code advisory describes a macOS sandbox arrangement in which an attacker-controlled subprocess could change a parent directory into a symlink between pathname validation and an unsandboxed Edit write. The canonical Case classifies the result as a time-of-check/time-of-use race, distinct from an agent deciding to disobey an instruction.
The authorization applied to a name, not a stable target
The vulnerable sequence had two actors: a shell process operating under its sandbox rules and a separate file-editing tool operating with the user's file access. The shell process could race the directory structure, while the edit tool checked and wrote through a path that no longer resolved to the same object. A file outside the permitted workspace could therefore be modified if the user account could write it.
This is a local privilege and filesystem-object problem. It does not establish administrative escalation, remote arbitrary file access on every deployment or escape from the host/container boundary. The risk depends on the affected macOS setup, the available attacker-controlled process and the destination's permissions.
The upstream record identifies the fix in Claude Code 2.1.251, with public disclosure on October 26. The relevant verification is to hold an open reference to the approved filesystem object or otherwise perform path validation and writing in one confined operation, then reproduce the symlink race safely before and after the patch.
The security advisory documents the specific context. A correct model-level refusal is not a substitute for preventing an approved write from being redirected to an unauthorized object.