Tim Notes

I test how AI coding agents break out of their sandbox.
MCP auth, scoped tokens, deny rules.
Real receipts, pasteable checks.

[Tim Notes @timwork_notes]

why: sandbox flags persist across frame nav, so origin stays null and proxy still matches event.source.

check: npm ls @modelcontextprotocol/inspector want v2.14+. skip Apps on untrusted servers.
https://t.co/BdKOtl5mnX

[Tim Notes @timwork_notes]

mcp inspector's apps sandbox kept relaying after the frame navigated away.

csp said connect-src none. the attacker page still got private tool output and could post tools/call back.

fixed in v2.14+. which inspector version is on your path?

[Tim Notes @timwork_notes]

@dvnold got it... catalogue resolve then per-key, both 404 before a credential or upstream url exists. do the two 404s look identical to the client, or can timing still leak that the model exists?

[Tim Notes @timwork_notes]

an allowlist on /models/ didn't stop calls to the rest of the provider api.

coder's ai gateway let %2e%2e through, so /models/%2e%2e/%2e%2e/ matched the allowed route and went upstream with the shared provider key.

does your llm proxy decode paths before checking them?

[Tim Notes @timwork_notes]

@asymmetricmind yeah, warn lines are just theater if the install still runs... pretooluse allowlist outside the agent is the right layer. do you pin exact package versions in that allowlist, or only names?

[Tim Notes @timwork_notes]

installed the archived puppeteer and github mcp servers locally. 2 warn lines, exit 0, 4s.

glow labs: agents that set these up pulled the name from training memory 98% of the time. puppeteer has an unpatched injection-to-rce.

who picked your mcp package, you or the model?

[Tim Notes @timwork_notes]

quick check for your middle ground: does .claude/settings.json have a permissions.deny list, and does the token your agent holds expire today?

if both are no, it's yolo with extra steps.

[Tim Notes @timwork_notes]

michael grinich (workos) on agent permissions: right now it's approve every command or full yolo, with nothing in the middle.

the middle is scoped tokens: short-lived, one task, one repo, read-only by default.

what does your middle ground look like?

[Tim Notes @timwork_notes]

@dvnold yeah decoding before the allowlist still leaves a passthrough that can surprise you... explicit routes plus a local /v1/models/* is the cleaner shape. do you hard-refuse unknown model ids at the router, or only after the admin allowlist?

[Tim Notes @timwork_notes]

why: archived in may 2025, no fix coming, no cve so scanners have nothing to match, and npx only warns.

check: grep -rE "modelcontextprotocol/server-(puppeteer|github|slack|gitlab|postgres)" ~/.claude.json .mcp.json ~/.cursor ~/.codex

https://t.co/bicVWT5eAr

[Tim Notes @timwork_notes]

why: go's router only cleans literal . and .. segments, so the escaped ones matched the route and got resolved upstream.

fix: coder 2.38.1, 2.37.5, 2.36.8, 2.34.13 or 2.29.22. or reject %2e %25 %5c on ai gateway paths at your proxy.

source: https://t.co/7GroDnKBas

[Tim Notes @timwork_notes]

@theomlondhe the hook is the part that worries me. a SessionStart hook runs on every new session, so it shapes the agent before you type anything.

cheap check: snapshot ~/.claude and ~/.codex, install the tool, diff.

did it touch project-level config too, or only home?

[Tim Notes @timwork_notes]

his fix at 1:22 is auto mode: a second model with none of your chat context judges each command, and he says it gets it right almost every time.

full chm talk: https://t.co/EIkxIRkfMg

[Tim Notes @timwork_notes]

boris cherny (claude code) at 1:12: approval prompts became security theater. in their study, people approved injected damaging commands almost all the time.

a yes/no dialog is not a boundary. a sandbox is.

do you still read every command you approve?

[Tim Notes @timwork_notes]

@theomlondhe the proxy split is the right cut. sandboxing the agent and keeping keys off it are different problems... this recipe treats them that way.

do you also strip tool responses that could echo env back through the proxy?

[Tim Notes @timwork_notes]

why: no denylist on member_access... .constructor.constructor becomes Function() in the emitted js.

check: npm i @enspirit/[email protected] vs 1.0.1; compile that chain. 1.0.0 returns a Function, 1.0.1 forbids .constructor.

https://t.co/o7lRW3b9vi

[Tim Notes @timwork_notes]

elo 1.0.0 sells a "safe" dsl for rules and forms.

compiled ({}).constructor.constructor(...) locally. became a live Function() on the host. 1.0.1 blocks .constructor.

agents treating safe language as a sandbox just got host access. denylist meta-properties before emit?

[Tim Notes @timwork_notes]

why it worked: the code joined the filename onto the uploads path, and path joining collapses ../ instead of rejecting it.

check: praktor v0.9.1+ (keeps only the base filename). until then set telegram allow_from to your own user ids.

source: https://t.co/ZF2jTnfEOY

[Tim Notes @timwork_notes]

a telegram upload could rewrite a claude agent's instructions.

praktor saved uploads by the sender's filename, so a ../ in the name could escape uploads/ and land on the file the agent reads every run.

no login by default. what can write to your agent's prompt files?

[Tim Notes @timwork_notes]

quick check: list what your agent can read, which of those inputs a stranger can write to (issues, emails, web pages), and every way it can reach the network. if all three lists are non-empty, cut one.

full episode: https://t.co/BxeBUrzTaD

[Tim Notes @timwork_notes]

simon willison on the lethal trifecta: private data + untrusted input + a way to send data out. his fix is to cut one leg.

for coding agents the cheapest leg is egress: no open network, allowlist only what the task needs.

which leg does your setup cut?