CVE-2026-101998: Anthropic Python fail-open proxy

CISO Take

Docker Sandboxes, which isolate AI coding agents, can fail open when masking credentials in protected proxy responses: if a response-body read returns data together with an error, the handler forwards the unmasked bytes. Code running inside an authorized sandbox can therefore recover the host-managed OAuth access and refresh tokens, or the derived Anthropic API key, that the design is meant to keep outside the sandbox. No CVSS, EPSS, KEV or SSVC data is available yet, and no public exploit or scanner template is known, so urgency rests on the architecture: the sandbox is the boundary used to contain untrusted or prompt-injected agent code, and this flaw breaks the credential isolation that boundary promises. Exploitation needs code execution inside the sandbox, which is the normal state of an agent that has been prompt-injected or is running a malicious dependency. Apply the Docker fix as soon as the vendor publishes it, and until then rotate and revoke any OAuth and Anthropic credentials used with sandboxes and watch provider logs for token use from unexpected locations.

Sources:NVDdocs.docker.comATLAS

What is the risk?

Severity is unscored, so treat it as provisional. Exploitability looks moderate to high once an attacker has code execution inside a sandbox, since no special privileges or user interaction appear to be needed. The impact is high for confidentiality: the stolen refresh tokens give lasting access beyond the sandbox lifetime, and a derived Anthropic API key allows cost abuse and access to the account's model resources. Exposure is limited to teams that use Docker Sandboxes with credential injection. Confidence is MEDIUM, because the assessment rests on the vendor-style description alone and no CVSS, EPSS or advisory detail has been published.

How does the attack unfold?

Initial Access

Attacker gets code to run inside an authorized sandbox, for example through a prompt-injected agent or a malicious dependency.

AML.T0051.001

Exploitation

The code triggers proxied responses where the body read returns data with an error, so the masking handler fails open and forwards unmasked bytes.

AML.T0106

Credential Harvesting

The code captures the host-managed OAuth access and refresh tokens and the derived Anthropic API key from the response.

AML.T0083

Impact

The attacker reuses the tokens and key outside the sandbox to access the victim's accounts and consume API resources.

AML.T0091.000

Initial Access

Attacker gets code to run inside an authorized sandbox, for example through a prompt-injected agent or a malicious dependency.

AML.T0051.001

Exploitation

The code triggers proxied responses where the body read returns data with an error, so the masking handler fails open and forwards unmasked bytes.

AML.T0106

Credential Harvesting

The code captures the host-managed OAuth access and refresh tokens and the derived Anthropic API key from the response.

AML.T0083

Impact

The attacker reuses the tokens and key outside the sandbox to access the victim's accounts and consume API resources.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	pip	—	No patch
4.0K5.4K dependentsPushed 8d ago93% patched~9d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

6 steps

Update Docker Sandboxes to the fixed release once the vendor advisory names it, and check the Docker documentation for the credential-injection guidance.
Rotate and revoke the OAuth access and refresh tokens and any Anthropic API keys that were used through sandboxes, especially where untrusted code or untrusted repositories ran.
Do not run untrusted code, repositories or third-party agent tools in sandboxes holding long-lived credentials until patched.
Use short-lived, least-privilege and spend-limited credentials for sandboxed agents.
Monitor provider audit logs for token or API key use from new IPs, unusual volume or unexpected models.
Review sandbox network egress for unexpected outbound traffic that could carry captured tokens.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionAgentAPIFrameworkAML.T0083- Credentials from AI Agent Configuration AML.T0091.000- Application Access Token AML.T0098- AI Agent Tool Credential Harvesting AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-101998?

Docker Sandboxes, which isolate AI coding agents, can fail open when masking credentials in protected proxy responses: if a response-body read returns data together with an error, the handler forwards the unmasked bytes. Code running inside an authorized sandbox can therefore recover the host-managed OAuth access and refresh tokens, or the derived Anthropic API key, that the design is meant to keep outside the sandbox. No CVSS, EPSS, KEV or SSVC data is available yet, and no public exploit or scanner template is known, so urgency rests on the architecture: the sandbox is the boundary used to contain untrusted or prompt-injected agent code, and this flaw breaks the credential isolation that boundary promises. Exploitation needs code execution inside the sandbox, which is the normal state of an agent that has been prompt-injected or is running a malicious dependency. Apply the Docker fix as soon as the vendor publishes it, and until then rotate and revoke any OAuth and Anthropic credentials used with sandboxes and watch provider logs for token use from unexpected locations.

Is CVE-2026-101998 actively exploited?

No confirmed active exploitation of CVE-2026-101998 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-101998?

1. Update Docker Sandboxes to the fixed release once the vendor advisory names it, and check the Docker documentation for the credential-injection guidance. 2. Rotate and revoke the OAuth access and refresh tokens and any Anthropic API keys that were used through sandboxes, especially where untrusted code or untrusted repositories ran. 3. Do not run untrusted code, repositories or third-party agent tools in sandboxes holding long-lived credentials until patched. 4. Use short-lived, least-privilege and spend-limited credentials for sandboxed agents. 5. Monitor provider audit logs for token or API key use from new IPs, unusual volume or unexpected models. 6. Review sandbox network egress for unexpected outbound traffic that could carry captured tokens.

What systems are affected by CVE-2026-101998?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding agent sandboxes, credential-injection proxies, LLM API gateways.

What is the CVSS score for CVE-2026-101998?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding agent sandboxescredential-injection proxiesLLM API gateways

MITRE ATLAS Techniques

AML.T0083Credentials from AI Agent Configuration

AML.T0091.000Application Access Token

AML.T0098AI Agent Tool Credential Harvesting

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.

Exploitation Scenario

An attacker plants a prompt injection in a public repository issue or README. A developer's coding agent running in a Docker Sandbox reads it and runs attacker-chosen code. The code makes requests through the protected proxy and repeatedly triggers responses where the body read returns data together with an error, so the masking handler passes the raw bytes through. The code extracts the OAuth access and refresh tokens and the derived Anthropic API key, sends them to an attacker-controlled endpoint, and the attacker uses them from outside the sandbox to access the developer's account and run up costs.

Weaknesses (CWE)

CWE-636Not Failing Securely ('Failing Open')CWE-636Not Failing Securely ('Failing Open')

CWE-636 — Not Failing Securely ('Failing Open'): When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.