A security researcher uncovered a data exfiltration flaw in the Anthropic experimental sandbox runtime. The vulnerability appears when a user sets "allowLocalBinding" to true in their settings. This configuration was intended to permit local port binding for development tasks.

However, it inadvertently opens a pathway for network requests. A malicious command could bypass domain restrictions by sending DNS queries for sensitive data, like SSH keys, to a subdomain of an attacker-controlled server. Because the sandbox restricts outbound traffic by domain, it was expected to block such requests.

Instead, the actual behavior allows the query to resolve if the attacker sets a specific NS record on their domain. This redirects the lookup to their own DNS servers, effectively smuggling data out. It's a classic case of a feature creating an unintended side channel.

This issue matters because sandboxes are meant to be secure, isolated environments for running untrusted code. Developers rely on them to prevent exactly this kind of leakage. The flaw forces a rethink of how network permissions are handled in containerized systems, suggesting that blocking domains alone isn't enough.

Future patches will likely need to scrutinize DNS resolution paths more closely or disable local binding by default.