Your Coding Agent Thinks Security Controls Are Bugs

Mon, 09 Mar 2026 00:00:00 +0000

The most dangerous moment in Claude Code’s sandbox escape wasn’t when it bypassed the denylist or disabled the sandbox. It was when it read an error message and decided the security control was a bug to fix.

That’s the takeaway from Ona’s research. Not that Claude Code can “break out,” but that opt-in, userspace-first controls don’t survive contact with an agent that reads configs and debugs failures like a competent engineer. No jailbreaks, no adversarial prompting. Just a coding agent that wanted to finish its task.

Sandbox on aeshift

Your Coding Agent Thinks Security Controls Are Bugs