Claude Will Find a Way

markdownlint-disable MD003 MD033 MD046

markdownlint-disable-line

" bullet hole in mirror " by Jo Naylor is licensed under CC BY 2.0.

For the last month or so I’ve been using Nono almost exclusively to sandbox my Claude Code agents. It works well, particularly in blocking egress to the outside world. I explicitly allow traffic to hosts that I trust and all other connections to untrusted hosts just don’t work. Or at least that used to be the case.

This weekend I find myself heading to Oslo to talk about better securing Perl, the CPAN and various other parts of the Perl ecosystem. More on that in a different post. While in town, I was thinking of doing some open water swimming, so I decided to do some dogfooding and see what was on offer atMy Mind is Racing. To my surprise, I didn’t find much at all, because my coverage in Norway is just not good. So I decided to import some more data. I have skills that write web scrapers to import data into My Mind is Racing. I decided to let some agents loose on Norwegian data and after kicking off the work, I moved on to something else. When I came back to check on the agents, I found something curious.

It turns out that I had made the mistake of accidentally starting my agents each in their own very restrictive Nono sandbox. Agent A did exactly what I expected. Given a URL, it tried to fetch it in a few different ways but failed because of the sandboxing. It was stalled and unable to complete the task. I’d have to add the required URLs to the sandbox allow list and then resume the agent’s work. Not a problem. On to Agent B. Imagine my surprise when I found that Agent B had completed the work. Agent B was in the same kind of restricted sandbox, but it managed to access various URLs which were clearly not on the allow list. This allowed it to complete its work – the work which I had asked it to do, despite the constraints which the sandbox had imposed. I had to ask Claude how it had managed to bypass the restrictions.

Olaf:…