been using Claude Code Auto Mode for like 2 months straight on client work
it just runs and u trust it. feels like a junior dev who never sleeps
then i saw that thread. Johann Rehberger broke Auto Mode with a supply chain trick. 60 to 80% code execution success. the exploit was a malicious site convincing Claude to curl a zip instead of using WebFetch. drops a shadowed Python struct.py and hijacks execution
scary part is i had zero sandboxing. been running Claude Code raw on my dev box with full access. just trusted it. u get comfortable and stop thinking about what the agent can actually touch
moved everything into dev containers last night. annoying to set up but if ur running agents with file system access. put it in a container. no excuses
also looking at DeepSeek Harness. open source and plugin based so u control what tools ur agent can touch. feels like the right direction
anyone else still running agents without isolation? or am i late to the party
Top comments (0)