The agent sandbox boundary
Vendors are moving the line around what an agent is allowed to reach, and the two largest labs are moving it in opposite directions.
-
ACTClaude Code 2.1.246 warns on Bash wildcard allow rules
a rule like Bash(git * main) also matches options inserted before the subcommand. The same release stops telemetry sending third-party gateway API keys to Anthropic hosts. Changelog
-
SHIPAnthropic ships a built-in browser in the Claude Cowork desktop app
browsing moves inside the agent instead of running through a separate extension or MCP server. The New Stack
-
Vendors are reclassifying agent guardrails from security boundary to convenience feature
Johann Rehberger, August 26, planted a shadowing struct.py that Claude imported in code it wrote itself, reaching remote execution at 60 to 80% in limited testing. Anthropic closed it “Informative”: auto mode is “a convenience feature backed by a best-effort classifier, not a security guarantee.” Anthropic's own published eval reported 0.00% attack success across 72 fixed scenarios. Simon Willison carried it August 27. Rehberger
-
ACTClaude Code 2.1.248 adds Restricted Mode
removes built-in execution tools and WebFetch, confines file tools to the working directory, and refuses bypassPermissions. It also stops uploading uncommitted prod.env and .tfvars edits in cloud sessions. Changelog
-
Embargo windows now close after the exploit, not before it
Anil Madhavapeddy, August 22, carried by Simon Willison August 28: ten minutes after he opened the public PR fixing an OCaml path traversal, his server was "fielding probes for percent-encoded traversal sequences." He puts 2026 mean time to exploit at minus seven days against roughly 63 days in 2018-19. rclone's Nick Craig-Wood: about 20 disclosures in ten years, "over 40 in the last month." Madhavapeddy · Willison
-
ACTClaude Code 2.1.251 fixes five permission bypasses
Symlinks swapped after the check, plugin commands pointing outside the plugin directory, and Workflow reading scriptPath before the check. Upgrade first if you run third-party plugins. Changelog
-
The sandbox network edge is the last boundary vendors defend, and the two labs are moving it in opposite directions
Friday's guardrail signal moved. After Johann Rehberger broke Claude Code auto mode on August 26, Anthropic's answer was that the sandbox is the boundary. On August 31 it required cyber evaluations to run "inside a hardened sandbox" with "no internet access" and API keys held outside. On August 30 Simon Willison found ChatGPT Work's code environment "can now talk to the rest of the internet," and "combines all three" trifecta legs. Anthropic · Willison · Rehberger
-
ACTWillison publishes a reverse-engineered ChatGPT Work reference
223 registered tools and 44 skills, mapped by asking the product to document itself, because OpenAI hides its system prompts. Its browser runs JavaScript against the DOM of loaded pages. Willison
-
Claude Code 2.1.252 fixes always-allow not saving in projects that have no settings.local.json yet. Changelog
-
Vendor patch turnaround for disclosed agent exploits is compressing to days
Johann Rehberger published a Claude Code Opus 5 auto-mode exploit August 26: a WebFetch redirect chained into a ZIP payload that hijacks Python's import system, which he put at 60 to 80% success against Anthropic's own claimed 0.00% attack-success benchmark. Claude Code 2.1.257, shipped September 1, adds a confirmation prompt for auto mode's first file read outside the working directory, closing the specific opening he used. Rehberger · Changelog
-
ACTClaude Code 2.1.257 closes the auto-mode exploit Rehberger published
A new confirmation prompt fires the first time auto mode reads a file outside the working directory, the exact opening Rehberger's zip and import-hijack chain used to reach 60 to 80% success. Upgrade if you run auto mode unattended. Changelog
-
ACTClaude Code 2.1.259 adds a Containment Escape rule for auto mode
The rule auto-blocks cloud metadata-credential fetches and cross-tenant reach, the next hardening step after August's Rehberger exploit. The release also adds org-managed MCP servers and a --permission-prompts none flag for unattended hosts. Changelog
-
WATCHA security startup says Anthropic took 50 days to patch a sandbox flaw OpenAI fixed in a week
Accomplish disclosed sandbox vulnerabilities in Claude Code, Codex and Cursor; OpenAI and Cursor patched within a week, Accomplish says, versus 50 days and 30 releases for Anthropic. Single source — Anthropic hasn't confirmed the timeline. Upstarts Media