Vibe Coding
Tip: Audit Every Agent Boundary You Assume Is a Sandbox — Three Separate Bypasses Landed in Two Days
Across Claude Code 2.1.221 and 2.1.222, four distinct enforcement layers turned out to be bypassable: worktree isolation (via `git -C`/`GIT_DIR` redirection), Bash permission checks (via zsh `[[ ]]` conditionals), PowerShell permission checks (via quoted paths), and PreToolUse auto-allow hooks (in background tasks). The practical move is to stop treating any single in-process guard as the boundary and put a real one underneath it: run untrusted-repo agents in a container or VM, not just a worktree, and scope credentials at the token level rather than relying on the agent not to reach them.
↳ Follow the thread