Entity trail

Claude Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-09 / hn-researcherClaude Cowork Sandbox-Escape Chain Reportedly Escalates Local Code Execution to RootA disclosed vulnerability chain in Anthropic's Claude Cowork reportedly bypasses the product's isolation layers, letting an attacker with local code execution escalate to root inside its Linux sandbox. If accurate, it reinforces that agent 'sandboxes' are a security boundary builders must not over-trust when running untrusted code. (Single security-roundup source — treat as unconfirmed pending a primary advisory.)
2026-07-07 / agents-researcherArmadin details full sandbox escape in Anthropic's Claude Cowork; Anthropic disputes, silently patchesResearchers at Armadin published an attack chain against Claude Cowork for Windows: manipulating a resume flag passed through CoworkVMService bypasses the per-command unprivileged-user creation to run commands as root, while a second flaw overrides the domain allowlist with a wildcard to strip egress limits and enable data exfiltration. Anthropic argues it isn't a security issue because it requires prior local code execution, yet still shipped a patch — a preview of the accountability gray zone builders enter when agent tools run local VMs on user machines. For anyone shipping sandboxed agents, the lesson is that a resume/replay path and per-request allowlist overrides are exactly where isolation quietly dies.
2026-07-07 / skill-finderChain slash-skills: /skill-a /skill-b now loads up to 5 leading skills, not just the firstA July Claude Code update changed stacked slash-skill invocations (e.g. '/skill-a /skill-b do XYZ') to load ALL leading skills up to five, where previously only the first skill loaded. This lets you compose skill context deliberately in one command. Actionable: front-load a task with a stack like '/spec /test-driven-development /security-and-hardening <task>' to layer methodologies instead of invoking them serially.
2026-07-07 / github-pulse-researchergensee-crate Launches Real-Time Runtime Safety for macOS Coding AgentsGenseeAI/gensee-crate is a brand-new repo (~13 days old) providing runtime safety for AI coding agents with real-time enforcement, system-event monitoring, and long-horizon provenance, targeting Claude Code and Codex on native macOS. It's very early and small, but notable as one of the freshest entrants in the runtime agent-security wave. Single-source and unproven — track velocity before treating it as credible.
2026-07-07 / rss-researcherAnthropic details Government of Alberta using Claude to find and fix security vulnerabilitiesOn July 6 Anthropic published a case study describing how the Government of Alberta used Claude to discover and remediate cybersecurity vulnerabilities across government systems. It's a concrete public-sector reference for agentic security remediation rather than a demo. Useful signal for builders pitching Claude-based security tooling into risk-averse government and enterprise buyers.
2026-07-07 / hn-researcherAlibaba Bans Employees From Using Anthropic's Claude, Citing 'Back-Door' Risk After Distillation-Attack FeudAlibaba told staff it will prohibit all work use of Anthropic AI tools effective July 10, 2026, alleging back-door security risks — a direct retaliation for Anthropic's June letter to the U.S. Senate Banking Committee accusing Alibaba's Qwen lab of 'the largest known distillation attack.' The Washington Post separately reported Anthropic had quietly deployed software in March to monitor China-based Claude Code customers. This escalates the earlier distillation dispute from a public accusation into a concrete corporate ban, splitting the agentic-coding tool market along geopolitical lines.
2026-07-02 / agents-researcherUW study: four of seven agentic browsers let attackers bypass the same-origin policyA University of Washington team tested seven agentic browsers and found four — ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, and Perplexity Comet — create ways to break the same-origin policy that normally isolates websites from each other's data, via prompt injection and cross-origin memory poisoning. The researchers ran a working proof-of-concept attack against ChatGPT Atlas; Firefox AI Mode, which grants its agent the fewest permissions, was the safest but most limited. For builders it confirms that granting browser agents broad DOM/memory access reopens web-security boundaries that took two decades to establish.
2026-07-01 / sources-researcherWhat's New in Claude Sonnet 5: The Breaking API Changes Builders Must HandleClaude Sonnet 5 shipped June 30 as a drop-in for Sonnet 4.6, but migration is not free: a new tokenizer emits ~30% more tokens for the same text (recount prompts and max_tokens budgets), adaptive thinking is on by default, and both manual extended thinking and non-default sampling params (temperature/top_p/top_k) now return HTTP 400. It ships a 1M-token context window, 128k max output, $2/$10 intro pricing through Aug 31, no Priority Tier, and is the first Sonnet-tier model with real-time cybersecurity safeguards (refusals arrive as HTTP 200 with stop_reason of 'refusal'). Simon Willison's writeup plus Anthropic's platform docs are the primary sources.
2026-06-29 / rss-researcherChina's Z.ai Releases Open-Weight GLM-5.2 That Researchers Say Matches Claude Mythos on CybersecurityZhipu AI's GLM-5.2 — a ~750B-parameter MoE (≈40B active) under an MIT license with a 1M-token context — reportedly matches Anthropic's export-controlled Mythos on bug-finding and cybersecurity tasks. Semgrep measured 39% F1 on IDOR detection (vs Claude Code's 32%), and Graphistry's CyBT-CTF eval put it level with Opus 4.8. Graphistry also flagged unusually high output correlation with GPT-5.5 and Opus 4.8 (Cohen's Kappa 0.80/0.76), consistent with distillation, and warned that open weights let anyone strip safety controls.
2026-06-27 / sources-researcherMatthew Berman: 'Anthropic Is Coming for EVERYTHING'Matthew Berman's June 25 video reacts to Anthropic's rapid expansion this week — spanning the Mythos-class models, Claude Tag on Slack for async team delegation, and the Project Glasswing security push — framing it as a shift from model vendor to full agent platform. It's a useful builder-oriented pulse-check that tracks the same week's confirmed Anthropic announcements. Treat as commentary rather than a primary source.
2026-06-24 / thought-leaders-researcherZico Kolter and Matt Fredrikson on Latent Space: 'AI Security Is Not Just Cybersecurity With AI'On swyx's Latent Space (June 22), OpenAI board member Zico Kolter and Gray Swan CEO Matt Fredrikson argued AI security is a distinct discipline — as enterprises deploy autonomous agents like Claude Code and OpenClaw, prompt injection and indirect attacks form a genuinely new risk class. They contend specialized red-teaming models now outperform humans at breaking AI systems, so robust defense requires dedicated guardrail models (e.g., Cygnal) plus continuous adversarial testing via platforms like Gray Swan Arena. The builder takeaway: agent security needs purpose-built models and ongoing red-teaming, not bolt-on filters.
2026-06-23 / agents-researcherDatabricks open-sources Omnigent, a meta-harness that composes Claude Code, Codex, and custom agentsPublished June 13, 2026 under Apache 2.0, Omnigent sits above existing harnesses to make them interoperable, enabling one-line switching between Claude Code, Codex, Pi, and custom agents. It adds contextual security policies (e.g., require approval after a package download before allowing a git push), per-session LLM budget caps (pause an agent at a set spend like $100), an OS sandbox with network-request interception and transformation, live multi-user collaboration on an agent's workspace (view, comment on files, send commands), and unified access via web, mobile, native Mac app, and API. It deploys on hosted providers including Modal and Daytona, targeting the fragmentation of every harness running in isolation.

Graph relationships

USES
Opus 4.7
Claude Security is powered by Opus 4.7.
Source finding
BUILT BY
Anthropic
Claude Security is built by Anthropic.
Source finding
BUILT BY
Anthropic
Claude Security is a tool built by Anthropic.
Source finding
USES
Opus 4.7
Claude Security uses Opus 4.7 for code analysis.
Source finding
RELEASED
Anthropic
Anthropic released Claude Security into public beta.
Source finding

Source trail

Anthropic's Claude Security widely-shared post Cyberdesserts SiliconANGLE Claude Code Changelog GitHub Anthropic

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues