Executive brief
The Anthropic Claude SDK for Python contains a security flaw in its asynchronous local filesystem memory tool, which is used to manage data storage for AI models. A local attacker could exploit this flaw to bypass security restrictions and read or write files outside of the intended storage area. This could lead to the exposure of sensitive system data or unauthorized modification of files on the host machine.
Technical details
A TOCTOU (Time-of-Check Time-of-Use) vulnerability exists in the `_validate_path` method of the `async` local filesystem memory tool in the Anthropic Python SDK. While the tool validates that model-supplied paths resolve within a sandboxed directory, it returns the original unresolved path for subsequent operations instead of the resolved absolute path. A local attacker with write access to the memory directory can exploit this window by replacing a validated path with a symbolic link (symlink) before the file operation occurs. This allows the attacker to escape the sandbox and perform unauthorized reads or writes on the host filesystem. The synchronous implementation is not affected. The issue is fixed in version 0.87.0 by ensuring the resolved path is returned and used.
Affected products
- Anthropic anthropic-sdk-python >= 0.86.0, < 0.87.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: Fixed in version 0.87.0
- 2026-03-31: advisory