Claude Code ships with OS-level permissions and a public harness. Between a 51-command security bypass, credential-scope attacks, and 512,000 leaked lines of internals, here’s the complete security picture, and the configuration that makes it safe to drive fast.
Claude Code: The Ferrari Most Developers Are Driving in First Gear<
At a glance:
- What happened: Researchers found Claude Code stops enforcing security rules after 50 chained commands; separately, 512,000 lines of its internal harness leaked through an npm source map.
- What it exposes: Security checks coupled to inference cost get skipped under pressure, and the permission model (silent –add-dir overrides, inherited subagent permissions) is now public knowledge.
- What to examine: Your flag combinations, credential scope, and whether any enforcement sits outside the agent’s own process.
Key quote: “AI just broke one of cybersecurity’s oldest rules. And almost no one noticed.”
Part I. When Security Stopped at 50 Commands
Key quote: “Translation: your security policy disappears exactly when you need it most.”
At 51 Commands, Your Security Model Stopped Existing
Key quote: “In 2026, Anthropic shipped a system that breaks… if you type 50 commands in a row.”
AI just broke one of cybersecurity’s oldest rules, and almost no one noticed.
In 1898, Auguste Kerckhoffs established the principle that a system must remain secure even if everything about it is known, the foundation of modern cryptography. In 2026, Anthropic shipped a system that breaks if you type 50 commands in a row. Let that contrast sit for a moment: more than a century of security doctrine, undone by a command counter.
Understanding Failure
Key quote: “Sounds safe. It isn’t.”
Here is what happened, in plain terms. Claude Code, Anthropic’s flagship coding agent, lets AI execute shell commands directly on your machine. To keep that power in check, it ships with deny rules like “never run curl” or “never run rm.”
Sounds safe. It isn’t.
Researchers discovered that when a command chain exceeds 50 steps, the system quietly gives up: it stops checking security rules, silently ignores deny policies, and instead prompts the user with “Too complex to verify… proceed?” Translation: your security policy disappears exactly when you need it most, at the precise moment a command becomes complex enough to hide something malicious.
Chained commands slipping past the point where rule checks stop. Illustrative artwork, not Anthropic documentation.
Rule checks are enforced through 50 chained commands, then skipped. Conceptual diagram of the 51-command bypass.
The Real Attack Path (This Is the Part That Matters)
Key quote: “This is SolarWinds-style blast radius, triggered by a README.”
Theory is useful, but walk through the actual attack, because this is the part that matters for your threat model. An attacker publishes a normal-looking GitHub repo and hides a payload in step 51 of the build process. You clone it and tell Claude Code to “build this project.” Your AI executes everything, including step 51, past the point where the security checks stopped running. Your secrets are gone.
What gets exfiltrated in a scenario like this?
- SSH keys → full repo and server access
- AWS credentials → cloud takeover
- GitHub tokens → CI/CD compromise
- npm tokens → supply chain attack
This is SolarWinds-style blast radius, triggered by a README. The uncomfortable question for your own shop: how many repos did your developers build with AI assistance this month, and how many of those build chains did anyone actually read past step 50?
Why This Is Bigger Than One Bug
Key quote: “Security checks cost tokens. Tokens cost money. So they… stopped checking.”
This wasn’t a random mistake. It was a tradeoff, and tradeoffs like this are structural, which is what makes them dangerous:
Security checks cost tokens. Tokens cost money. So they… stopped checking.
Let that sink in, because it reframes the entire problem. AI security is now economically coupled to inference cost: every guardrail burns tokens, and tokens are margin. This is the first visible crack in that coupling, and it almost certainly won’t be the last. Every vendor selling you an AI agent is doing the same math in private. The only question is where they drew their line.
What We Know
Key quote: “The secure fix already existed in the codebase. It was never deployed to users.”
Sticking strictly to what is confirmed:
- The bypass was real and exploitable
- It affected ~500K+ developers
- The secure fix already existed in the codebase
- It was never deployed to users
- Likely patched in newer versions (quietly)
That third point deserves emphasis, because it is the most damning: the secure fix already existed in the codebase and was never deployed to users. This wasn’t a hard problem nobody had solved. The solution was written, reviewed, and sitting there. It just never shipped.
What We Don’t Know
Key quote: “How long this existed in production”
And here is what remains unknown. The questions that should keep practitioners up at night:
- How long this existed in production
- Whether it’s been exploited in the wild
- How many similar shortcuts exist across other AI agents
- Which vendors are making the same tradeoff right now
Honest uncertainty is better than false confidence. Treat every one of those unknowns as an open risk until evidence closes it.
Lessons Learned (Read This Twice)
Key quote: ““Ask the user” is NOT a security control.”
Five lessons, each earned the hard way. Read them twice. The second time, substitute your own agent stack and ask whether each one still holds:
- “Ask the user” is NOT a security control. In CI/CD and automation, “ask” = auto-approve.
- Config files are the new attack surface. CLAUDE.md is the new input(). We are reliving SQL injection… with AI.
- Performance optimizations = security risk. Every “fast path” needs adversarial review.
- Your vendor’s security = the code path you run. Not the one they demo. Not the one they wrote. The one they shipped.
- AI agents invert trust boundaries. You are no longer executing code. The AI is executing you.
Why You Should Care
Key quote: “…this is your problem. Not theoretical. Operational.”
This is the section to skim if you’re short on time, but only to check whether any of it applies to you. If you use AI coding agents, run untrusted repos, touch cloud infrastructure, or own a software supply chain, then this is your problem. Not theoretical. Operational. The vulnerable population here isn’t “someone else’s developers”. At ~500K+ affected developers, it is statistically likely to include yours.
Bottom Line
Key quote: “In agentic AI, security is a cost center competing with the product itself.”
This wasn’t just a bug. It exposed a structural truth:
In agentic AI, security is a cost center competing with the product itself.
And when that tension hits margin pressure, security loses, not because anyone chose to be insecure, but because the economics quietly made the insecure path the default. If you’re deploying AI agents today and not red-teaming them like an adversary, you’re not using a productivity tool. You’re onboarding an insider threat, one that works at machine speed, never sleeps, and inherits every credential you forgot to scope.
Part II. The Credential-Scope Gap
Key quote: “A package install is code execution with extra steps. An agent running npm install on a poisoned repo is already compromised.”
The 51-command bypass was about checks that stopped running. The next failure mode is about credentials that were never meant to be in reach.
As Slade (llm_redteam) put it in September: the exploit in “just opening a repo can pwn your coding agent” isn’t the shell. It’s credential scope. Most agent setups export API keys into the shell environment, so the moment an agent can execute commands, it inherits everything the developer’s shell can touch.
The supply chain is already being worked. Slade’s Sep 15 capture documented the RubyGems OpenAI agent attack: 2,000+ malicious packages shipped in 48 hours, and the operators didn’t bother hiding. Hundreds of gems with “oai” in the name, 15 listing “oai” as author, one registered to openaixyz65947@gmail.com. Agents that install first and verify never are the target demographic.
The practical fix is credential scoping for coding agents:
- No ambient API keys. The agent’s shell environment should not inherit your full credential set. Scope keys per session, per task.
- Treat install steps as untrusted input. A package install is code execution with extra steps. An agent running npm install on a poisoned repo is already compromised.
- Separate the keys that build from the keys that deploy. If one command chain can reach both, you have one credential, not two.
This is the attack vector that sits between the bypass in Part I and the configuration guide in Part III: the permissions were wrong before the agent ever ran.
Permission flags live inside the agent and can be relaxed by prompt. An external control cannot. Conceptual diagram.
Part III. Drive the Ferrari Safely
Key quote: “and the adversary just got the full service manual.”
It’s Time to Start Moving Faster with Claude Code. But Do It Safely!
Key quote: “This is the article I wish existed last week.”
Someone once described Claude Code as “a Ferrari most developers only drive in first gear.”
After the leak, I’d add: and the adversary just got the full service manual.
Here’s the question that framing should provoke: if your developers are driving in first gear, what gear is the adversary driving in, now that they have the manual?
512,000 lines of TypeScript. 1,900 files. The complete internal harness; permission gates, bypass logic, JWT auth structures, subagent orchestration models, all of it reconstructable from a source map artifact that shipped accidentally in an npm package. Downloaded. Forked 56,000+ times and climbing. 21 million views on X before Anthropic could respond.
This is the second time. The first leak was February 2025. Same root cause. Same build pipeline gap. Thirteen months to add one CI check. They didn’t.
Here’s what I want to talk about though, not the leak itself, but what the leak revealed. Because buried in those 512,000 lines is a product most developers aren’t fully using yet. An agent orchestration platform wearing a terminal UI. And understanding both the capabilities AND what the leak means for each one is exactly what most coverage missed.
This is the article I wish existed last week. Bookmark it. You’ll read it twice and don’t forget to leverage the additional free resources at the end.
What Was Actually Exposed (And Why It’s Different From What the Headlines Said)
Key quote: “The media called it an IP leak. That’s technically true and substantively wrong about what matters.”
The media called it an IP leak. That’s technically true and substantively wrong about what matters.
Nicolas Chaillan, who brought GenAI to the US government as the former Air Force and Space Force Chief Software Officer, put it precisely in his own breakdown: what was exposed wasn’t just source code. It was the complete internal harness. The software layer that governs how Claude Code validates permissions, implements guardrails, handles subagent spawning, and defines trust boundaries.
Critically: it also exposed 44 feature flags for fully-built but unshipped features. Not vaporware. Compiled code, sitting behind flags, ready to ship.
And here’s the part Nicolas highlighted that mainstream coverage glossed over: an adversarial AI pointed at that codebase can systematically map every trust boundary in hours. Generate proof-of-concept exploits automatically. Traditional zero-day discovery required skilled humans doing manual code review for weeks. That’s not the model anymore.
Tom Bragg, who helps CIOs modernize legacy systems, raised the fair counterpoint when we talked through this: no LLM swallows 512k lines in one prompt. Token windows don’t work that way. He’s right. But an agent doesn’t have to. It traces. It scopes. It hands targeted sections to engineers who know exactly what they’re looking for. AI plus humans doing targeted analysis of a known codebase is a different threat than either alone.
Importantly: Claude Code is an agent with real OS-level permissions inside your environment. It touches your codebase, your credentials, your internal systems. A zero-day in the harness isn’t a jailbreak. It’s potential lateral movement. That’s the frame for everything that follows.
The Features (What the Leaked Code Actually Reveals You Should Be Using)
Key quote: “Claude Code is an agent orchestration platform disguised as a terminal chat.”
A developer named mal_shaik spent hours reading through the full source and put it simply: “Claude Code is an agent orchestration platform disguised as a terminal chat.” The people getting 10x output from it aren’t better prompters. They configured it. They parallelized it. They hooked into it.
Here’s the honest breakdown. Features first, risk woven in where it matters.
The Architectural Shifts (These Change How You Think, Not Just How Fast You Work)
Matt Flannery, who works with life sciences commercial teams at Slalom Consulting, said something in our conversation that stuck with me: “/batch and /branch are the ones that change how you think about work, not just speed. Forking sessions and fanning out to hundreds of agents means you stop thinking sequentially.” He’s right. And that distinction, thinking shift versus speed boost, is the cleanest way to group these features. The risk profile is completely different between the two.
/batch. Fan Out to Hundreds of Agents
This is the one. /batch interviews you about the task, then fans out to as many parallel worktree agents as needed. Dozens. Hundreds. Thousands for large migrations. Each agent gets its own isolated branch, working in parallel.
Ahad Shams, who runs Meta ad workflows, restructured his entire process after reading the leaked coordinator mode implementation. He went from sequential steps (pull data → wait → analyze → wait → generate copy → wait) to four agents running simultaneously: one pulling campaign data, one auditing spend and ROAS, one generating copy variations, one flagging budget leaks.
His full account audit went from ~5 hours to under 2. 60% faster. From reading leaked source code.
The architectural reality the source code reveals: when Claude Code forks a subagent, it creates a byte-identical copy of the parent context. The API caches this. So spinning up 5 agents costs barely more than 1 running sequentially. The architecture is built for this. Using it single-threaded is leaving capability on the table.
The risk dimension: When you fan out to 100 agents via /batch, the blast radius of any single compromised subagent becomes instantaneous. The leaked code exposed exactly what the permission inheritance looks like across subagent spawns, and in bypass mode, all spawned subagents inherit full autonomous access. The source reveals this clearly. Matt put the compliance implication well: auditors in regulated environments don’t want to see a log of good behavior. They want to see the physics that prevent bad behavior.
Human-speed governance cannot keep pace with machine-speed execution at this scale.
/branch. Fork Your Running Session
/branch forks a running session into two parallel threads. You’re deep in context on a hard problem, you want to explore an alternative approach without losing where you are. Branch it. The existing session keeps running. The fork takes a different path. Compare outcomes.
The source code also supports –resume –fork-session from the CLI for branching from past sessions. The JSONL session persistence at ~/.claude/projects/{hash}/{sessionId}.jsonl means context accumulates across sessions. Most developers start fresh every time. That’s like closing your IDE every hour. The architecture is explicitly built for accumulated context.
The risk dimension: Child sessions inherit the parent’s permission state. If the parent session has any compromised permission flags, and the leaked code documents exactly what those flags look like, the forked session carries that forward.
/loop and /schedule. Autonomous Execution Over Time
Boris Cherny, the engineer who built Claude Code at Anthropic, runs dozens of loops locally at all times. /loop 5m /babysit auto-rebases and addresses code review comments on all PRs. /schedule runs Claude on autopilot at set intervals up to a week.
The risk dimension: The leak exposed Anthropic’s exact telemetry flags, which means adversaries now know not just how the system works, but precisely where the monitoring isn’t. Autonomous loops running over extended periods, in documented telemetry blind spots, against a permission harness whose bypass logic is now public, this specific combination warrants external oversight.
The Speed Multipliers (More Immediately Usable)
| Feature | What It Does | Key Config | Risk Surface |
|---|---|---|---|
| Hooks | Inject logic at 25+ lifecycle events | PreToolUse, PostToolUse, UserPromptSubmit | First layer adversaries probe, not sufficient alone |
| –add-dir | Full read/write to additional repos mid-session | /add-dir mid-session | Silent override bug: –dangerously-skip-permissions + –permission-mode plan = UI lies |
| –agent | Custom system prompt + scoped tools per role | .claude/agents/ | Cleanest way to reduce surface by role |
| /btw | Side questions while agent keeps working | Inline during task | Minimal, primarily productivity |
| -w | New session in fresh git worktree | Dozens of parallel Claudes, same repo | Same trust inheritance as /branch |
| –bare | Skip auto-loading CLAUDE.md, settings, MCPs | 10x faster startup | Explicitly load only what you need |
| –teleport | Move sessions between phone/web/desktop/terminal | /remote-control for anywhere access | Native C2 channel, needs network-level controls |
The Hook System in Depth
The source code reveals 25+ lifecycle events and 5 hook types (command, prompt, agent, HTTP, function). The UserPromptSubmit hook is particularly powerful. You can inject additionalContext into every single message automatically. Attach test output, recent git diffs, project state, to every prompt without typing it.
Real developer uses: auto-run linting before every file write, run tests after every edit, inject relevant docs into every prompt, send Slack notifications when tasks complete, route permission prompts to WhatsApp for mobile approval.
The honest framing: hooks are exactly the mechanism you’d use to add external control logic around Claude Code’s behavior. They’re also, now that the harness is public, the first mechanism an adversary would probe. Hooks are most powerful as the outermost layer of a layered control architecture, not when they’re the only layer.
–add-dir. The One to Be Most Thoughtful About Right Now
Full read/write permissions to additional folders and repos. Not just visibility. And you can add directories mid-session.
Here’s the specific issue from the leaked code: combining –dangerously-skip-permissions with –permission-mode plan causes the bypass to silently win.
The developer thinks the agent is safely planning. It isn’t. The UI lies. The agent has root.
–add-dir in that state isn’t “Claude has access to another repo.” It’s uncontrolled read/write access while the interface shows you otherwise.
Know the flag combinations you’re running. Understand your actual permission state, not what the UI displays.
–agent. The Most Overlooked Feature
Boris Cherny calls this the most overlooked feature in Claude Code. Load a custom system prompt and tools from .claude/agents/. Define specialized agents with scoped toolsets: reviewer (read-only), deployer (write with constraints), researcher (search only).
A reviewer agent with read-only scoped tools is a fundamentally lower-risk execution context than a deployer agent with write access. This is the feature that most directly implements the principle of least privilege in your agent architecture, and it was sitting there the whole time.
/btw. The Side Channel That Keeps You Moving
Simple but underused: /btw lets you ask side questions while the agent keeps working. Treat it like a quick search without interrupting the task. Boris uses it constantly. The async generator architecture underneath means the stream continues. Your /btw question routes separately. Zero interruption cost.
The Remote Control Stack
Key quote: “They’re also, architecturally, a native Command and Control channel.”
–teleport, /remote-control, and Cowork dispatch form a cluster worth treating separately because the architecture is different from the others.
–teleport moves sessions between phone, web, desktop, and terminal. /remote-control controls a local session from anywhere. Cowork gives you remote control of your entire laptop, not just code. Files, Slack, everything. Boris has remote-control-by-default enabled in settings and uses it daily.
These are genuinely powerful for async work. They’re also, architecturally, a native Command and Control channel. In the post-leak environment, this cluster specifically benefits from network-level controls, not just application-layer trust.
The Leaked Feature Flags. What’s Coming
Key quote: “Each of these represents an additional execution surface shipping into an environment where the harness internals are already public.”
44 unshipped features compiled behind flags. The roadmap is a release schedule:
| Flag | What’s Coming | ||
|---|---|---|---|
| KAIROS | Persistent assistant, background sessions, 4-phase subagent loop | BG_SESSIONS | Background agents running 24/7 with GitHub webhooks |
| COORDINATOR_MODE | One Claude spawning and managing worker Claudes | VOICE_MODE | Voice command integration |
| WEB_BROWSER_TOOL | Full browser control via Playwright | KAIROS_DREAM | Agents that sleep and self-resume |
| EXTRACT_MEMORIES | Persistent memory across sessions | BUDDY | AI companion pet system (genuinely charming, 18 species, rarity tiers, hats) |
| ULTRAPLAN | 30-minute remote planning via OCR browser instance | DAEMON | Long-running supervisor with workers |
Each of these represents an additional execution surface shipping into an environment where the harness internals are already public. The architectural decisions you make now are the ones you’ll scale into that expanded surface.
What the Source Code Analysis Reveals About the Architecture Itself
Key quote: “the implicit trust model was already load-bearing more than it should.”
Rohan, who builds AI staffing infrastructure at getheadcount.io, did an exceptional deep-dive into the engineering quality of the leaked code. His findings are worth integrating because they’re directly relevant to risk:
- The main REPL interface is 5,005 lines in a single React component with 227 hook calls. Functionally difficult to isolate-test. The // TODO: fix this comment next to an eslint-disable at line 4114 is the team acknowledging it.
- 61 files with circular dependency workarounds. Entire files created purely as import cycle band-aids. Lazy requires create gaps where TypeScript can’t help at compile time.
- 89 feature flags, 960 references, scattered everywhere. When you have KAIROS, KAIROS_BRIEF, KAIROS_CHANNELS, KAIROS_DREAM, KAIROS_GITHUB_WEBHOOKS as separate flags, that’s not gradual rollout. That’s a parallel product built inside the codebase.
The relevance for security: Tom raised this directly. These aren’t just code quality issues. An agent with execution privileges, built on a codebase with 61 documented circular dependency workarounds and a 5,000-line untestable core component, running with OS-level permissions, the implicit trust model was already load-bearing more than it should. The leak made that visible.
CLAUDE.md. The Highest Leverage Thing Nobody Does Properly
Key quote: “If you do one thing after reading this, it’s this.”
From reading the source: CLAUDE.md is loaded on every single query iteration. Not at session start. Every turn. You get 40,000 characters.
Most developers use maybe 200.
The hierarchy:
- ~/.claude/CLAUDE.md, global (your coding style, preferences)
- ./CLAUDE.md, project level (architecture decisions, conventions)
- .claude/rules/*.md, modular rules
- CLAUDE.local.md, private notes (gitignored)
Put your architecture decisions in there. Your file conventions. Your “never do this” rules. This is the difference between Claude Code being a generic assistant and Claude Code being YOUR assistant that knows YOUR codebase. If you do one thing after reading this, it’s this.
The Permission System Is Designed to Be Configured, Not Clicked Through
Key quote: “Every time you stop to click ‘allow’ is time wasted. Configure it once.”
The source reveals a 5-level settings cascade: policy > flag > local > project > user.
In ~/.claude/settings.json, you can set glob patterns for what’s always allowed.
Three permission modes: bypass (no checks, dangerous but fast), allowEdits (auto-allows file edits in working directory), and auto (runs an LLM classifier on each action, the sweet spot). Auto mode races multiple resolvers in parallel: user click, hook classifier, bridge. First one to respond wins.
Every time you stop to click “allow” is time wasted. Configure it once.
The Practical Developer Checklist
Key quote: “If you ran Claude Code against untrusted repos on any version below 2.0.65, rotate your Anthropic API key.”
Immediate. Do this now:
- If you ran Claude Code against untrusted repos on any version below 2.0.65, rotate your Anthropic API key. CVE-2026-21852 creates a confirmed key exfiltration path via pre-trust requests.
- Audit your flag combinations. –dangerously-skip-permissions + –permission-mode plan = silent bypass.
- Review your –add-dir scope. Know what repos are in play for any running session.
Before scaling /batch or /loop:
- Map the blast radius before you fan out. What can a compromised subagent reach?
- Define your enforcement boundary: inside the agent’s process (hooks only) or outside it?
- Know where telemetry stops. The leaked code documents the dead zones.
Before enabling remote control:
- Network-level controls around /remote-control and –teleport. Application-layer trust alone isn’t sufficient right now.
- Cowork dispatch is full laptop remote access. Treat it accordingly.
As you build agent roles:
- Use –agent to scope tools explicitly by role.
- Don’t rely on UI indicators alone given the documented silent override behavior.
High-leverage config actions:
- Write a real CLAUDE.md, 40K chars, loaded every turn
- Parallelize with subagents. Fork model shares prompt cache, 5 agents ≈ cost of 1
- Configure permissions in settings.json. Eliminate click fatigue
- Use /compact proactively. 5 compaction strategies exist because context pressure is real
- Set up hooks. 25+ events, this is the real extension API
- Always –continue sessions. JSONL persistence + session memory = accumulated context
The Enforcement Boundary Question
Key quote: “Biological speed cannot govern machine speed.”
This is where the conversation I had with Matt Flannery in life sciences landed with precision. He said: “The Runtime Governor concept is interesting because it moves the constraint from policy (‘you should not do this’) to architecture (‘you cannot do this’). That distinction matters in regulated environments where the audit trail needs to prove the violation was impossible, not just that someone chose not to violate.”
That’s the exact legal standard for regulated environments, and increasingly the right standard for any enterprise deploying agents at scale.
Biological speed cannot govern machine speed. When you fan out 100 agents via /batch, human review gates that made sense for sequential workflows become structurally insufficient. The enforcement boundary needs to move outside the agent’s process. Controls the agent’s code cannot see, influence, or bypass.
We open-sourced the AI SAFE² Claude Code Sovereign Runtime Defense Package specifically for this. MIT license. 15-minute setup for individuals. It wraps the agent in an external deterministic Runtime Governor, making it mathematically irrelevant what’s in the harness. If a hijacked subagent attempts an unauthorized state transition, the external layer severs it before it commits. The package is linked below.
The principle isn’t vendor-specific: the Cloud Security Alliance’s Agentic Trust Framework formalizes this as a zero-trust requirement for AI agents. External enforcement is the standard the industry is converging on. The leaked code just made the urgency visible.
Verify your setup: inspect flags, test past 50 commands, decide on external control. Proposed verification steps.
The Bottom Line
Key quote: “You don’t build brakes to slow the engine down. You build them so you can drive fast safely.”
These features are real. The productivity ceiling is real. The reason to use Claude Code is still valid after the leak, arguably more so, because the developer community is finally paying attention to capabilities most weren’t using.
What the leak changed is the implicit trust model. “Vendor-managed safety” as your sole enforcement layer has a structural limit that was always there. The harness internals are now a known quantity to adversaries. The silent override bug is documented. The telemetry dead zones are mapped.
You don’t build brakes to slow the engine down. You build them so you can drive fast safely.
The features are worth using. Build the cage first. Then floor it.
Links & attribution (from the originals):
- Full implementation guide, feature tables, and architecture diagrams: https://cyberstrategyinstitute.github.io/ai-safe2-framework/guides/claude-code-velocity-and-governance.html
- Claude Code Sovereign Runtime Defense Package (MIT, 15-min setup): github.com/CyberStrategyInstitute/ai-safe2-framework/tree/main/examples/claude-code-sovereign-runtime
What to Do Next
1. Inspect. Audit your Claude Code flag combinations (–dangerously-skip-permissions, –permission-mode, –add-dir scope) and list every credential the agent’s shell can reach.
2. Test. In a sandbox, run a chained command past 50 steps against a canary file and confirm whether deny rules still fire. Rotate any keys that may have been exposed (see CVE-2026-21852).
3. Decide. If enforcement lives only inside the agent’s process, pilot an external control layer on one workflow; document which paths it covers before scaling /batch or /loop usage.
Find Your Exposure First
Free AI governance assessment. Instant score, no sales call required.
Score Your AI Risk in 8 Minutes · Book a Strategy Briefing
Vincent Sullivan is Founder & CEO of Cyber Strategy Institute, architect of the AI SAFE² Framework, and a former Technical Director at USCYBERCOM. CVE-2026-21852 mitigation guidance is in the runtime package.
