Adversa AI: Claude Code Shell Command Deny Rules Silently Stop Working After 50 Subcommands — Critical Sandbox Escape
Adversa AI·medium signal
Adversa AI discovered that Claude Code's shell command deny rules (used to restrict dangerous commands) silently stop enforcing after 50 subcommands in a session. An attacker could craft a prompt that burns through the subcommand counter with benign operations, then execute restricted commands undetected. This is a session-state exhaustion bug, not a traditional prompt injection. For anyone using Claude Code deny rules as a security boundary, this means they're a speed bump, not a wall.