Sandbox is off by default in Claude Code. Even when you enable Claude’s sandbox, my understanding is that it still gives itself read access to your whole system, and you have to enumerate every path it shouldn’t be able to read. I’m reading the docs now and having trouble understanding how I’d even configure it to say, “You can only read the current directory.”
My point is that Claude Code and Codex are insecure by default, and they make you do a lot of work to restrict their access rather than designing the agents to use the least privileges necessary to do their work.
Surely, there was some sort of filesystem permissions or limited chroot kind of protection that prevents a random and unpredictable piece of software from exploring my entire computer unfettered, right?
Not so. The docs encouraged me to write the LLM a polite letter kindly requesting that it not read certain files or directories.
And
agents are only usable if you give them access to everything
The first quote follows the sentence “when I first started using my coding agent,” which was two years ago. It’s not describing the situation today.
The second quote is accurate today of Claude Code and Codex. They expect access to everything by default and it’s the user’s responsibility to figure out how to limit access. Even with Claude Code’s sandbox, I don’t see a way from the docs to restrict read access to a single repo directory.
Which part is wrong?
Sandbox is off by default in Claude Code. Even when you enable Claude’s sandbox, my understanding is that it still gives itself read access to your whole system, and you have to enumerate every path it shouldn’t be able to read. I’m reading the docs now and having trouble understanding how I’d even configure it to say, “You can only read the current directory.”
My point is that Claude Code and Codex are insecure by default, and they make you do a lot of work to restrict their access rather than designing the agents to use the least privileges necessary to do their work.
score 1 · canonical
Statements such as:
And
score 1 · canonical
The first quote follows the sentence “when I first started using my coding agent,” which was two years ago. It’s not describing the situation today.
The second quote is accurate today of Claude Code and Codex. They expect access to everything by default and it’s the user’s responsibility to figure out how to limit access. Even with Claude Code’s sandbox, I don’t see a way from the docs to restrict read access to a single repo directory.
score 1 · canonical