Sandbox escapes

Boundaries that looked enforced but were not.

• Command denylists are bypassed with base64, subshells and scripts

  Backslash showed Cursor's auto-run denylist let blocked commands through when encoded, wrapped in a subshell, or put in a script.

  • Sandbox escapes
  • Cursor

• File commands escape the working directory through absolute paths

  Claude Code blocked cd to parent directories but still let rm and cat reach files anywhere through absolute or ~/ paths.

  • Sandbox escapes
  • Claude Code