Researchers show a booby-trapped repo could escape Claude Code's sandbox with no prompt

Stealth security startup Accomplish published a disclosure on September 11, 2026 for a vulnerability it calls "Beltdown": opening an untrusted repository in Claude Code could let that repo execute commands on the user's Mac outside the tool's sandbox, without triggering a permission prompt. Principal security researcher Oren Yomtov, who wrote the disclosure, said a command from the repo ran "outside the sandbox, with no permission prompt." Accomplish reported the bug to Anthropic on July 13, 2026. A partial hardening shipped August 6 in version 2.1.223, which Accomplish says was incomplete, and the full fix landed in version 2.1.247 on August 26.

How the chain works

Beltdown is five issues stacked together:

• git's core.fsmonitor setting can be configured to execute an arbitrary shell command during routine repository operations.
• Claude Code runs git commands outside its sandboxed Bash tool, unlike other commands it executes.
• A git ls-files call the harness runs wasn't hardened against that config option.
• Nested .git folders can be created and renamed to dodge protections that only checked root-level .git directories.
• The agent's skill auto-loading feature triggers the automatic file-index refresh that sets off the chain.

Anthropic's fix blanks the core.fsmonitor setting on every git command Claude Code runs.

Three vendors, three disclosures

Accomplish also flagged sandbox-escape issues in OpenAI's Codex and in Cursor. Alex Konrad's account at Upstarts Media says Cursor and OpenAI shipped fixes in about a week each, against the roughly 50 days and 30 releases Accomplish says Anthropic needed to close Beltdown. Accomplish co-founder Or Hiltch asks why, if the labs' models are as capable as claimed, those models aren't catching critical vulnerabilities in the labs' own coding-agent products before outside researchers do.

If your developers run Claude Code, confirm they're on 2.1.247 or later, and treat any untrusted repository as untrusted code before opening it in a coding agent.