Local Filesystem Access Vulnerability in Anthropic Python SDK by Anthropic
CVE-2026-34452
What is CVE-2026-34452?
The Anthropic Python SDK provides access to the Claude API. Versions from 0.86.0 to before 0.87.0 contain a flaw in the async local filesystem memory tool. This flaw allows a local attacker who has write access to the memory directory to exploit the validation process of model-supplied paths. By manipulating a symlink between the validation stage and subsequent file operations, the attacker can escape the intended sandbox, leading to potential unauthorized reads or writes. This could compromise the integrity of the system. The vulnerability was resolved in version 0.87.0.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
anthropic-sdk-python >= 0.86.0, < 0.87.0