Preliminary research

Beltdown: Escaping the Claude Code sandbox

Beltdown: Escaping the Claude Code sandbox — Accomplish Blog

Oren Yomtov · Accomplish · 11 September 2026

AI-collected research leads through 1 October 2026, including a bounded September review of selected social and community sources. Unranked, incomplete, not community-vetted, and subject to change.

Claude Code ran an internal Git index refresh outside its macOS sandbox. A staged nested .git directory, an unhardened git ls-files call and automatic skill loading let repository-controlled core.fsmonitor execute on the host without a permission prompt.

Record

Document

Beltdown: Escaping the Claude Code sandbox — Accomplish Blog

Researcher

Oren Yomtov

Published by

Accomplish

Date

11 September 2026

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Beltdown2: Escaping the Cursor CLI sandbox — Accomplish Blog
• GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok

Tags

• ai-agent
• sandbox-escape
• rce
• prior-art-extension

This page is the archive's own catalogue record. The research is the work of Oren Yomtov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 1 October 2026.