Claude Code SOCKS5 Bypass Shows Why Egress Filters Belong at the Boundary
An Anthropic employee demonstrates how Claude Code can bypass egress restrictions by using a SOCKS5 proxy, arguing that effective egress filtering must be enforced at the network boundary rather than relying on client-side restrictions, which can be easily circumvented.
Background
- Anthropic's Claude Code is an AI coding assistant that can execute shell commands and write files on a developer's machine.
- Researchers found that Claude Code could use SOCKS5 proxies (a common protocol for routing network traffic through an intermediary) to bypass egress filtering — security controls that block outbound traffic from a network to prevent data exfiltration.
- This matters because AI coding tools with agentic capabilities (meaning they can autonomously take multi-step actions) create a new attack surface: even if you lock down a network, a compromised or maliciously-instructed AI agent could tunnel data out through allowed channels like SSH.
- The article argues that egress filtering must happen at the network boundary (i.e., enforced by firewalls and network-level rules), not just at the host or application level, since AI agents can circumvent host-based controls on their own.