His Coding Agent's Test Launched Real Processes on His Mac, and It Only Got Caught Because It Talked: Why He Now Sandboxes Every Background Agent
- Level Advanced
- Setup1–3 hrs (estimated)
- Evidence Some evidence
- CostNot stated in source
- No-codeNo
What they did
A developer ran seven Claude Code subagents in parallel in auto mode with no sandbox. One wrote a test with a one-line bug (an empty fake launcher list counts as false in Python), so the test started four real processes on his Mac: two read JSON aloud with the say command, and two upload workers defaulted to his production server. Nothing was sent only by luck. The agent fixed the bug 7 seconds later and never mentioned the side effect. He traced it through the macOS unified log, not the transcripts, and now sandboxes every agent, keeps live credentials out of instructions, makes tests fail if they reach production, and asks agents to report unexpected side effects.
How it went
Incident report by the developer (Oct 29, 2026), also on Hacker News: Claude Code in auto mode, 7 parallel subagents, no sandbox; bug written, run and fixed in 23 seconds; 4 detached processes started, 2 upload workers defaulted to the production ingest URL but sent nothing; agent didn't report it; traced with the macOS unified log. Single incident, he says it isn't a measurement of how often this happens; reported to Anthropic
Worth knowing
- Incident report by the developer (Oct 29, 2026), also on Hacker News: Claude Code in auto mode, 7 parallel subagents, no sandbox; bug written, run and fixed in 23 seconds; 4 detached processes started, 2 upload workers defaulted to the production ingest URL but sent nothing; agent didn't report it; traced with the macOS unified log. Single incident, he says it isn't a measurement of how often this happens; reported to Anthropic.
Prompt
Cleaned version rewritten from the source — not a direct quote.
Before you run any background or parallel coding agents on this machine, help me lock them down. Set up each agent so it can only write inside its own worktree, can only reach an allowlist of network addresses, and can't read config or credentials in my home folder. Make sure no live tokens appear in agent instructions. Change our test setup so tests point at a dead local endpoint and fail if any real process launcher is called. Then add a rule to every agent's instructions: in your hand-back, report any unexpected side effect (processes started, network calls, files outside the worktree), not just whether tests pass.
Recommended
Try it in Grok Bot
- Copy the prompt (button below).
- Open Grok Bot chat and paste it. Replace any [bracketed] placeholders.
- Connect the listed tools (as needed) as connectors when Grok Bot asks.
- If the task repeats, ask: "Make this a daily routine."
Alternatives: the same prompt works in Claude Code, Claude, ChatGPT Agent, OpenClaw.
Set it up
Stack: Claude Code
- Read the original source for full context.
- Connect the tools your agent needs.
- Paste the prompt and replace [bracketed] placeholders.
- Run once manually and check the output before scheduling it.
Generic suggested steps, not from the source.
Evidence
Incident report by the developer (Oct 29, 2026), also on Hacker News: Claude Code in auto mode, 7 parallel subagents, no sandbox; bug written, run and fixed in 23 seconds; 4 detached processes started, 2 upload workers defaulted to the production ingest URL but sent nothing; agent didn't report it; traced with the macOS unified log. Single incident, he says it isn't a measurement of how often this happens; reported to Anthropic
Source: Web · 2026-10-29 · Verified by us: not yet · Report broken or outdated