Beltdown: patch latency is now a vendor metric

We covered the mechanism last week when GitSpawn showed that opening a folder can run code. This week the same class of bug produced a more useful number. Tel Aviv startup Accomplish published Beltdown, a Claude Code sandbox escape, and along with it a disclosure timeline. The bug took 44 days to fully close. Competitors shipped fixes for comparable bugs in about a week. If you are choosing which coding agent your team runs, patch latency just became a spec you can compare.

What actually happened

Per Accomplish's write-up, an untrusted repository opened in Claude Code on macOS could escape the sandbox and run commands as the logged-in user, with no permission prompt.

The chain is the now-familiar one. Claude Code's harness ran git ls-files outside the sandbox without hardening it. Git honors core.fsmonitor, whose value is a command Git executes. Planting a poisoned .git folder in a nested directory sidestepped the root-level protections, and asking Claude to read a single file in that folder triggered the index refresh that fired the payload.

The clock:

• July 13 — reported to Anthropic
• August 6 — partial fix in 2.1.223, incomplete
• August 26 — full fix in 2.1.247

Forty-four days by Accomplish's own dates. Upstarts Media, which broke the wider story on September 10, put it at roughly 50 days and noted it spanned about 30 software updates. In the same reporting, Cursor closed a July-flagged issue in about a week and OpenAI fixed two in the same window; OpenAI said it "addressed both issues in August." Anthropic and Cursor did not comment on the record.

Accomplish CTO Or Hiltch asked the question the industry has been avoiding: if these models are so good, why are they not finding critical vulnerabilities in their own products?

Why patch latency belongs in your vendor scorecard

Your coding agent runs with your credentials, in your repos, on the machine that also has your production keys. That makes it infrastructure, and you already score infrastructure vendors on how fast they respond. Start scoring this one.

Time-to-fix is measurable and comparable. You do not need to audit anyone's sandbox. Read the CVE records and public disclosure timelines for the tools you run, and note the gap between report and fix. A vendor that ships thirty releases without closing a reported escape has told you where security sits in its queue.

Partial fixes are the number that matters. Beltdown got a fix on day 24 that did not hold. Anyone tracking "was it patched?" would have marked it green three weeks early. Track "was it closed?" instead.

Version pinning is a security decision now. If your team is three minors behind on a coding agent, you are running the vulnerable build of whatever got quietly fixed last month. Put agent versions in the same update cadence as your OS patches, and know who owns that job.

Pick one afternoon this month: list every AI tool with filesystem or shell access in your shop, find its latest published advisory, and write down the days between report and fix. That column is your vendor risk ranking.

Sources: Accomplish: Beltdown — Escaping the Claude Code Sandbox, Upstarts Media.