Tag
6 posts tagged.
If your agent has a tool that takes a URL, the model chooses where your server connects. Measured end to end on Node 24 with no dependencies and no API key: the guard most people write fails four ways, including the IPv4-mapped IPv6 bypass behind CVE-2026-56266, which also defeated the first version of my own hardened guard.
The prompt injection guardrail is third in the bundle and the HTML sanitizer is fourth, so markup the sanitizer strips rejoins a banned phrase after the detector has already passed it.
You gave your agent a shell tool, used execFile so there is no shell, and allowlisted the programs. It is still not safe. If the agent controls the argument array, tar's own --checkpoint-action=exec runs any command with no metacharacters. Here is the reproduction and the per-binary argument policy that stops it, measured on Node 24.8.0.
If your agent has a read_file tool, you probably guard it with path.resolve plus startsWith. It blocks the obvious traversal and is defeated by a symlink and by a sibling directory sharing the prefix. Both reproduced on Node 24.8.0, with the guard that passes all nine cases.
Claude Code v2.1.260 narrowed strict sandbox mode so it no longer covers commands you type at the ! prompt. Anthropic documents two exceptions the changelog never mentions, and the variable that closes the gap is filed under credential scrubbing.
Claude Code v2.1.251 stopped project settings setting CLAUDE_CODE_TMPDIR, CLAUDE_CONFIG_DIR, HOME, TMPDIR and the XDG family from a .claude/settings.json env block. Nothing errors. Here is the full ignore list, the four scopes it splits into, and the debug flag that shows you the drop.
