A single git config file broke Claude Code's sandbox. That's the AI tool your estimator might be using to build spreadsheets

A stealth security startup called Accomplish escaped Claude Code's sandbox this summer using nothing more exotic than a setting buried in a repository's own .git/config file — then found related trust-boundary gaps in OpenAI's Codex and in Cursor. None of the three bugs required the victim to be a professional software engineer. They only required someone to point the AI coding agent at a repository that wasn't fully trustworthy, which is exactly how a growing number of construction firms without an in-house dev team are starting to use these tools: forking an open-source takeoff calculator, cloning a vendor's sample integration, or asking an agent to adapt someone else's estimating script.

What did the researchers actually find?

Accomplish's technique, which it calls "Beltdown," abuses Git's core.fsmonitor setting — a value Git reads from .git/config and runs as a shell command any time it needs to check which files changed, including during an ordinary git status or git diff. By planting a poisoned config inside a nested Git worktree and getting Claude Code to touch a single file in that folder, the researchers got the agent to trigger a routine index refresh that executed their payload — with the ability to overwrite files like .zshenv in the user's home directory and run code outside Anthropic's "seatbelt" sandbox restriction entirely. Anthropic tracked the bug as CVE-2026-55607 and fixed it in Claude Code version 2.1.163. Accomplish reported similar gaps to Cursor, where a workspace-controlled hook file could trigger unsandboxed command execution, and to OpenAI, where a Codex CLI safety allowlist trusted the git show command by name even though its actual invocation could still write to disk.

Why does this matter if your firm doesn't employ developers?

Because the pitch for tools like Claude Code, Cursor, and Codex isn't just "write code faster" — it's "safe to point at code you don't fully trust, because it runs in a sandbox." That claim is what makes them attractive to a construction back office with no engineering staff: a precon manager forking a public bid-tab formatter, an estimator adapting a GitHub script for parsing spec PDFs, an ops director asking an agent to wire together a scraper for material pricing. Each of those starts with pointing the tool at a repository someone else wrote. Accomplish's research doesn't say every such repository is dangerous — it says the sandbox that was supposed to contain the damage if one is could be defeated with a single config file, and none of the three vendors caught it before an outside researcher did.

Did the vendors respond the same way?

Not close to it, according to Accomplish's account of its own disclosure:

That gap matters beyond bragging rights. If your firm — or a construction-software vendor you rely on — is choosing which AI coding layer to build on, "how fast do they close a reported security hole" is now a real, comparable data point, not a hypothetical one.

What should a construction firm actually do?

1. Don't run these agents against a repository, template, or plugin you didn't write or fully vet — especially anything pulled from an unfamiliar GitHub account or a "free construction AI script" shared in a forum or group chat.
2. Keep the machine running the agent off the same network segment as your accounting, ERP, or project-management systems where possible. A sandbox escape on a workstation that can also reach QuickBooks or Procore is a much worse day than one that can't.
3. Update on the vendor's cadence, not your own. These fixes only help once installed; auto-update settings exist for a reason.
4. Ask any vendor building "AI agent" features on top of these tools how they patch disclosed vulnerabilities, and how fast. A 50-day answer is now a documented data point, not a guess.

None of this means stop using AI coding tools for internal scripts — it means treat "sandboxed" as a claim to verify, not a guarantee.

We covered a related pattern in OpenAI's agents quietly ignoring their own "read-only" restriction — this is the same lesson from a different angle: the access-control promise an AI tool makes on paper and what actually holds up under a determined test are two different things.

Forward this to whoever on your team has started "vibe coding" internal tools with an AI coding assistant.

Friday one chart. Every week, one piece of data that should change a decision on your project. Subscribe at constructionaibrief.com.