$ the-wire · showcase
sandbox-runtime blocks DNS-resolved private IPs, buffa stops double-writing bytes
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
anthropics/sandbox-runtime now refuses allow-listed hostnames that resolve to loopback, link-local, or configured private ranges, closing a hole where a wildcard allowlist plus a hostile DNS record reached unguarded addresses.
The allowlist decided by name only. Whoever controlled a permitted name's DNS records, or any label under a permitted wildcard, decided what that name resolved to, and nothing between the allowlist decision and net.connect() looked at the resolved address. So with "allowedDomains": ["*.example.com"] a sandboxed process could request internal.example.com, have it resolve to 127.0.0.1 or 169.254.169.254, and connect anyway [1]. That guard merged and shipped in v0.0.76 [2].
In anthropics/buffa, encode_to_bytes built a BytesMut::with_capacity(size), wrote through it, and froze it. Because bytes does not mark <BytesMut as BufMut>::put_slice #[inline] (it does for Vec<u8>), BytesMut has no put_u8 override, and LLVM folds reserve_inner into put_slice, encode_to_bytes was 3 to 4x slower than encode_to_vec on every benchmark shape, with or without LTO. It now writes through Vec<u8> and is within noise of encode_to_vec. The change is pure performance: no behavioural or wire impact [3].
Plugin registries saw a coordinated addition: the HubSpot plugin, sourced from HubSpot/hubspot-mcp-plugins, landed in anthropics/claude-plugins-official and was mirrored into anthropics/knowledge-work-plugins [4][5], alongside a GC AI plugin from GC-AI-Inc/gc-ai-claude-plugin in the official registry [6]. Separately, knowledge-work-plugins bumped its security-guidance entry from ed404106 to 3ea32df2 [7].
If you run sandboxed processes behind a domain allowlist, the v0.0.76 release changes what those allowlists permit: hostnames resolving into loopback, link-local, or configured private ranges are now refused [1][2]. Audit any wildcard entries that intentionally pointed at internal services.
Action items
- → Upgrade sandbox-runtime to v0.0.76 so allow-listed hostnames resolving to loopback, link-local, or private ranges are refused anthropics/sandbox-runtime [immediate]
- → Audit allowlist wildcard entries that resolve to internal addresses, since they will now be refused anthropics/sandbox-runtime [plan]
- → Switch encode_to_bytes call sites to the Vec<u8> path for the 3 to 4x encoding speedup anthropics/buffa [plan]
- → Pull the security-guidance bump in knowledge-work-plugins from ed404106 to 3ea32df2 anthropics/knowledge-work-plugins [monitor]
References
- [1] Refuse allow-listed hostnames that resolve to loopback, link-local or configured private ranges ↗ anthropics/sandbox-runtime
- [2] Merge pull request #528 from anthropics/release/v0.0.76 ↗ anthropics/sandbox-runtime
- [3] encode: `encode_to_bytes` writes through `Vec<u8>`, not `BytesMut` ↗ anthropics/buffa
- [4] Add hubspot-sales plugin ↗ anthropics/claude-plugins-official
- [5] Add hubspot-sales plugin ↗ anthropics/knowledge-work-plugins
- [6] Add gc-ai plugin ↗ anthropics/claude-plugins-official
- [7] Merge pull request #1103 from anthropics/bump/security-guidance ↗ anthropics/knowledge-work-plugins
