The vulnerability is a race condition in the asynchronous memory tool of the Anthropic Python SDK that allows a locally privileged attacker to bypass sandbox isolation by manipulating path validation. A requested path is validated to stay inside the sandboxed memory directory, but the tool returns the unresolved path for subsequent file operations. This permits an attacker who can create a symbolic link after validation to redirect reads or writes outside the intended directory, potentially accessing sensitive files or modifying system data. The weakness falls under CWE-367 and CWE-59.

The affected vendor is Anthropics, product Anthropic Python SDK. Versions from 0.86.0 through just before 0.87.0 contain the flaw. Users of older libraries or custom forks that have not applied the patch are susceptible. The issue is specific to the asynchronous implementation; the synchronous memory tool is unaffected.

CVSS score is 5.8 indicating moderate severity. As exploitation requires local write access to the SDK's memory directory, the attack surface is limited to environments where the application runs with sufficient permissions. No EPSS score or KEV listing is available, but the moderate CVSS combined with the local privilege requirement suggests restricted exploitation risk. Updating to version 0.87.0 removes the race condition, limiting the potential for sandbox escape.