Agreed, the whole tool is vibe-coded out the wazoo and I do not trust it in the slightest. I run a bubblewrap script which vastly limits what Claude has access to. Sometimes this makes things difficult but the trade-off is worth it to me.

The entire Hugging Face hack involved escaping major sandboxes, this emergent (or intended) behavior in a smaller scale is still a real issue.