Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Anthropic SDKs

CVE-2026-34452: Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape

mediumCVSS 4.0 5.8 · 3.1 5.3GHSA-w828-4qhx-vxx3

The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the sandbox.

Published Apr 1, 2026 · Updated Apr 24, 2026

Affected packages

anthropic

Ecosystem
PyPI
Affected
>= 0.86.0, < 0.87.0
Fixed in
0.87.0
Check
pip show anthropic

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the sandbox. The synchronous memory tool implementation was not affected.

Users on the affected versions are advised to update to the latest version.

Claude SDK for Python thanks hackerone.com/kasthelord for reporting this issue!

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Anthropic SDKs vulnerabilities

All Anthropic SDKs entries