待翻譯：Never Trust Your AI Agent's Own Sandbox

AI 服務暫時不可用，以下為來源正文，待恢復後補全翻譯。

For the last few weeks I’ve been trying to sandbox agents on my machine. Coding agents and other autonomous ones that fire on a trigger and run a workflow while I’m not watching. I have Little Snitch on my laptop. Every day Claude Code updates itself and pulls 300 to 400 MB, sometimes a gigabyte. Some of that is probably several instances grabbing the same update at once. 1.41 GB down from claude.ai just after connecting to the internet. Then I ran it under nono, which sandboxes a process at the kernel level and tells you what it denied. That’s how I found it reaching for markdown files in my notes, because a skill still had references pointing there. It was also trying to talk to Chrome, because I have the Claude for Chrome browser extension installed. nono blocked both. The interface never mentioned either. I never knew what it did behind the scenes this whole time. And that’s the actual worry. Not that Claude Code is malicious, but that Claude Code is capable, has a great amount of access to my system, and can be tricked. A prompt injection sitting in a page it fetches. A package name it invents and then installs. It’s a high agency tool accessing my shell, my keys and my network, and it only has to be fooled once. So I need to sandbox it. That’s the standard answer for any binary you don’t trust, and sandboxing is much older than AI. Both Claude Code and Codex ship one now. Seatbelt on macOS, bubblewrap on Linux, enforced by the operating system rather than by the model behaving itself. Then I read what Claude Code’s sandbox actually does. Default read access allows reading your entire disk. Anthropic’s own words: “this default still allows reading credential files such as ~/.aws/credentials and ~/.ssh/.” No sensitive files are protected unless you name it yourself, because there’s no built-in list of credential files. If the sandbox can’t start, Claude Code “shows a warning and runs commands without sandboxing.” And it only covers Bash - “Read, Edit, and Write use the permission system directly rather than running through the sandbox” - so the tools whose whole job is touching your files sit outside it. Then there’s this. When a command fails, “Claude analyzes the failure and may retry the command with the dangerouslyDisableSandbox parameter.” The model decides when to reach for that “feature”. In July, Anthropic disclosed that its own models had reached the internet from inside an evaluation environment and got into the production infrastructure of three organizations. One published a malicious package that was “downloaded and run on 15 real systems.” Anthropic called it “closer to a harness and operational failure than a model alignment failure.” The same labs telling you how capable their models have become at offensive security are shipping the harness you’re trusting to run on your laptops. You can’t trust the sandbox that comes with the thing you’re sandboxing. The Deeper Problem If you think from both sides - the LLM Harness & Sandbox - you’ll discover there’s a conflict of interest. When you subscribe to Claude Code, you’re not buying a chatbot. You’re buying agency - the ability to do whatever it takes to finish the job. Read the file. Hit the endpoint. Debug the thing nobody described properly. Look at the config it was never told about. Freedom plus intelligence is the product. Every restriction costs you some of that agency. Block the network and the answers get worse. Allowlist domains and deep research stops working, because most blogs worth reading sit on a domain you didn’t list. Deny reads on the home directory and it can’t reach GitHub or sign a commit with your SSH key. Every one of these sandboxing measures makes their product perform worse. So do you trust the LLM provider’s product teams to ship the most secure sandbox - one that cuts the very reason people pay for the product? I don’t. It’s the same reason you wouldn’t accept a company’s pentest report on its own product with zero criticals and highs. That isn’t a pentest report. It’s marketing. I’d like to be proven wrong. Tags: AI Security Opinion