A security researcher utilized Claude to examine its execution environment, retrieve an internal orchestration binary, recover authentication tokens from process memory, and bypass a local connection restriction protecting a sandbox control service This article explores capabilities enforcing profile. . Two distinct enterprise findings were assigned the same classification.
Claude revealed that its environment operates within a gVisor container, featuring mounted directories, network configurations, and internal tools. Claude explained it as an internal controller overseeing process management, filesystem mounts, resource limits, and communication with the broader platform.
Claude’s file-download API, which accepted the binary’s absolute path and returned it instead of limiting downloads to user-facing directories, was subsequently reverse-engineered to understand its communication methods and authentication requirements. This dump included fragments of JSON Web Tokens, including Google Cloud service account ID tokens and tokens associated with Anthropic infrastructure. A custom script was used to reconstruct missing token bytes and verify signatures using Google’s public verification keys.
The /mount_root endpoint responded with an HTTP 101 Switching Protocols, initiating a WebSocket connection and delivering service responses. The researcher recommended hardening measures: restricting downloads to designated directories, limiting access to infrastructure-process memory, reducing unnecessary network capabilities, and enforcing profile permissions server-side. Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and minimize manual workload.
