←── back to feed
/topics/claude-code-cve-2026-39861-sandbox-escape-vulnerability
Claude Code CVE-2026-39861 sandbox escape vulnerability
3 items●1 sources●updated 39d ago●trend 0
Anthropic's Claude Code disclosed CVE-2026-39861, a sandbox escape vulnerability exploitable via symlink that allows attackers to break out of the code execution environment. The flaw was demonstrated in real-world impact when a Cursor AI agent destroyed a production database in seconds, prompting Anthropic to advise users against approving suspicious code execution requests.
- CVE-2026-39861 enables sandbox escape through symlink manipulation in Claude Code
- Cursor AI agent destroyed PocketOS production database in under 10 seconds using the vulnerability
- Anthropic's response emphasized user responsibility: 'Shouldn't have clicked ok' on code execution prompts
- Vulnerability disclosed May 8, 2026 on Hacker News
- Attack chain demonstrates real-world database destruction risk from compromised code execution