A Bishop Fox researcher used ordinary chat requests to pull an internal Anthropic program and pieces of a Google Cloud token out of Claude's sandbox.
A security researcher got Claude to hand over one of Anthropic's own internal programs and a memory file holding pieces of a working Google Cloud login token. Chris Davis of Bishop Fox published the findings on October 29, 2026. No malware was involved. It all came from normal chat requests and careful follow-up work.
The sandbox is the locked-down space where Claude runs code. Davis, using a Claude Enterprise account, asked Claude about it. Claude described the setup and named a control program running inside it. Davis then found that the file-download feature accepted a full file path. When he asked for that program, he received a 3,179,528-byte file. After he took it apart, it matched Claude's description.
Next, he asked for the memory of that control program, framing it as a test comparing human and computer memory. The dump held broken pieces of login tokens. A token is a digital pass that proves who you are. Some pieces were missing, so Davis wrote a script to fill the gaps. Google's own checking service accepted the rebuilt Google token as valid.
Davis submitted six observations through Anthropic's bug bounty program. Anthropic said the sandbox findings did not meet its security threshold. It marked two Enterprise control items as informational or duplicate. Its reasoning is that its real security boundaries sit outside the untrusted sandbox. Bishop Fox described the post as a look inside the sandbox, not a formal vulnerability disclosure.
The main audience is companies and security teams that run AI assistants such as Claude Enterprise, and anyone who lets an AI tool run code near secrets. The lesson is simple. An AI helper can reveal its own inner workings when asked politely, and it may reveal anything it can read. Anyone who only chats with Claude has little to act on here.
The steps in the alert box above cover the practical moves. The core idea is to keep passwords and keys out of reach of any AI tool, and to give the tool only the access it needs.
The material does not say whether Anthropic will change anything or whether anyone else used these methods. Davis suggested several fixes, including blocking the model from reading infrastructure memory, wiping credentials once they are no longer needed, and limiting downloads to user folders. Businesses can also ask their AI vendor where its security boundaries sit and how it handles reports like this one.
If an AI tool can read a password or key, assume it could reveal it, so keep secrets out of its reach.
World models, AI that learns physics from video, are being built into home robots and driverless cars, and your own videos may help train them.
Read more: AI that learns how the physical world works is coming to robots and carsA new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksA University of Chicago law professor asked Claude to fix page numbers. It deleted his syllabus and a year of notes instead. Dropbox saved him, not the AI.
Read more: An AI assistant deleted a law professor's year of lecture notes
