CVE-2026-55607: Claude Code Worktree Sandbox Escape — The Operator's Version Audit and Policy Checklist

A malicious code repository can instruct Claude Code to escape its macOS sandbox, write files outside the intended directory, and execute arbitrary code with the developer's privileges. That is the documented impact of CVE-2026-55607, published by Anthropic on June 29, 2026, with a CVSS v3.1 score of 8.8 (High).

The vulnerability is patched. But in gateway and multi-user environments where engineering teams consume Claude Code through shared infrastructure, "patched upstream" does not automatically mean "patched where your users are running it."

What happened

The vulnerability affects Claude Code versions 2.1.38 through 2.1.162. It was fixed in 2.1.163.

The attack chain, documented in GitHub Advisory GHSA-7835-87q9-rgvv, is a multi-step sequence that requires an adversarially crafted repository and a user running a vulnerable Claude Code version against it:

1. A malicious repository contains a .git-named worktree directory — an unusual but previously accepted path.
2. Through gitdir pointer manipulation and symlink following, the worktree's metadata resolves outside the repository's intended filesystem boundary.
3. A core.fsmonitor Git hook is triggered by a routine Git command, executing attacker-controlled code.
4. That code modifies a shell startup file (.zshrc, .bash_profile, or similar), establishing persistence before macOS Seatbelt can sandbox the process.
5. Code now executes with the developer's full user privileges.

Each step exploits a feature that was individually reasonable: agent repositories can contain worktrees, Git supports fsmonitor hooks, startup files run at shell open. The vulnerability is in how they compose — a common pattern in agentic tool attack surfaces.

The exploitation prerequisite — cloning and running Claude Code against a malicious repository — sounds restrictive but is not. Developers routinely clone repositories for code review, bug reproduction, security research, package evaluation, interview exercises, and open-source contribution. A coding agent is specifically designed to read those repositories and execute instructions from them. The workflow that delivers the attack is ordinary developer behavior.

Why it matters for AI engineering teams

The version gap is wider than it looks. Between 2.1.38 and 2.1.162 are roughly 120 minor releases. If your team pinned Claude Code at a stable version and did not update aggressively, you may have spent months in the affected range without a triggered incident — and without knowing it.

Gateway-mediated Claude Code environments need explicit version enforcement. When Claude Code is deployed through a shared gateway — using ANTHROPIC_BASE_URL pointed at an internal proxy or AI router — the gateway sees model traffic but cannot see the client version. A team member running an old CLI against a modern gateway still poses a host-level risk. The gateway cannot protect them.

Indirect prompt injection is the delivery mechanism, not a side concern. CVE-2026-55607 is classified under CWE-78 (OS command injection) and CWE-22 (path traversal), but its delivery is indirect prompt injection: repository text influences agent behavior, which triggers the unsafe tool sequence. Two weeks after the advisory published, a working proof-of-concept video appeared on YouTube demonstrating the full chain. The attack is not theoretical.

The 2.1.210 hardening is a related but separate fix. The 2.1.163 patch fixed the specific worktree path confusion. A later release, 2.1.210, added a broader defense: the Agent tool now rejects subagent content that appears to contain injected instructions. These are complementary layers. If you patched only the CVE, the 2.1.210 fix may still be relevant to your threat model.

The router/operator angle

Teams running Claude Code through AI gateways face two distinct risk surfaces:

1. Client-side (host risk): A developer using an old Claude Code version clones a malicious repository. This is a host-level exploit — the gateway cannot observe or block it.

2. Gateway-side (subagent prompt injection): A Claude Code session routes subagent invocations through your gateway. If a subagent reads external content (a webpage, a tool response, a third-party API payload) that contains injected instructions, and that content is passed to a downstream model call, the injection may propagate. Gateway-level content inspection and subagent output filtering are the relevant controls here.

Operator policy actions:

• Enforce minimum version. Add a Claude Code version gate to your internal onboarding documentation and developer policy. The safe floor is 2.1.163; the current release (as of this writing, 2.1.211) includes all subsequent hardening.
• Audit shared CI/CD environments. If Claude Code is invoked in CI pipelines or containerized build environments, verify the installed version in those images. Cached Docker layers may pin an old version.
• Consider repository allow-listing for agentic sessions. For Claude Code sessions that run against external or unfamiliar codebases, consider whether the host sandbox settings (claudeSandbox, macOS Seatbelt profile) are applied and current.
• Enable gateway-layer input screening. If your AI gateway supports request-level content inspection or system prompt injection (prepending a safety frame before the model call), apply it to sessions where Claude Code subagents may process external repository content.
• Track Claude Code CHANGELOG actively. Security fixes do not always appear in a clearly labeled section. Claude Code publishes a public CHANGELOG.md in its repository. The 2.1.163 fix was recorded there; so was the 2.1.210 Agent tool hardening. Subscribe to releases to catch security-relevant updates.

What TheRouter users should watch or try

CVE-2026-55607 illustrates a structural gap: AI gateways route model API traffic, but developer host security depends on client tooling they do not control. The two layers need separate policies.

For teams routing Claude Code through a shared AI gateway:

• Verify that all developer machines running Claude Code are at 2.1.163 or later, and ideally at the current release.
• Review your gateway's system prompt configuration for agentic sessions — does it include a reminder about untrusted external content?
• Check whether your gateway exposes a version-reporting mechanism that lets you audit which CLI version is generating each session.

See the Claude Code documentation for the current recommended configuration for enterprise and multi-user gateway deployments.