The filtering done by auto mode (generally) catches accidental prompt injection, but isn't effective against actual attacks: https://embracethered.com/blog/posts/2026/breaking-claude-co...
reply(Anthropic themselves acknowledges this; see the end of the post.)
What are the sandboxing / isolation options that would protect against attacks like this?
replyRunning Claude code in an isolated, temporary VM, with no access to memory is a good start. You give it your repo, prompt and you get back PRs. Claude code on web is a convenient way to do that.
replygiven that claude has found vm escapes, you might consider going one step further and just getting a claude only laptop
replyYou need a laptop that has no camera, mic, keyboard, or any type of input. No display, speakers, or any type of output. No Bluetooth, wifi, or any way to join a different network.
replyI configured remote VPS and cloudflare sandboxes to run my agents.
replyWho says that such options necessarily need to exist?
replyYour employer worried about exfiltration
replyI found it worthwhile reading how auto mode works[0]. The short version is that the classifier only sees user messages and the tool call. So if your agents communicate via tool calls, the classifier doesn’t see that text at all (or any other prompt injection) and will block a potentially dangerous command.
reply[0] https://www.anthropic.com/research/claude-code-auto-mode
auto mode is a bad joke
reply>they won't actually follow instructions without checking in with me
replyUntil they suddenly once in a while they do, and Goldman Sachs loose some billions because of it...