# Claude-Sandbox Egress Allowlist Bypass Attempt

- **Severity:** High
- **Signature ID:** `d3a1e9f2-4b7c-4c1a-9e3f-7b2a6d9c1e45`
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This rule flags command-line activity inside a Claude-sandbox environment (bubblewrap-based) that tries to escape the network restrictions meant to limit what the AI agent can reach. If successful, an agent or attacker could bypass the allowlist and send traffic to arbitrary destinations instead of only approved hosts.

## How the attack works

An attacker or a compromised/manipulated agent process running inside the sandbox tries one of several methods to regain full network access: re-enabling network sharing in the bwrap sandbox launcher, joining the host's network namespace with nsenter or ip-netns, flushing or disabling the local firewall rules, or rewriting /etc/hosts or /etc/resolv.conf so an allowlisted hostname resolves to a different, attacker-controlled address. Any of these steps defeats the isolation the sandbox is supposed to enforce, letting outbound traffic go somewhere it shouldn't.

## Why it matters

If the bypass works, data the agent handles can be exfiltrated to unapproved destinations, or the agent can be steered into fetching and running attacker-controlled content, even though the sandbox's egress allowlist was supposed to prevent that.

## What you can do

- Review any nsenter, ip netns, iptables/nftables flush, or /etc/hosts and /etc/resolv.conf edits originating from inside sandboxed agent containers, and confirm they were operator-initiated.
- Restrict which processes inside the sandbox have the privileges needed to modify network namespaces, firewall rules, or DNS/hosts files.
- Treat debugging or CI jobs that intentionally flush firewall rules or edit host resolution files as a known, documented exception, and keep them separate from production agent runtime.
- Alert on any bwrap invocation from within an already-sandboxed process that requests network sharing be re-enabled.

## Known benign look-alikes

- Network diagnostics run intentionally by an operator via nsenter to inspect host networking from inside a debugging container
- CI/CD or test-suite jobs that legitimately flush and reapply firewall rules to validate network-isolation test cases
- Container entrypoint or provisioning scripts that append service-discovery records to /etc/hosts or rewrite /etc/resolv.conf during normal startup
- Sandbox test fixtures that intentionally invoke bwrap --share-net to validate network-allowed test cases for the sandbox itself

---
Source: https://www.netzilo.com/threats/claude-sandbox-egress-allowlist-bypass