I've many times seen Claude try to execute a command that it's not supposed to, the harness prevents it, and then it writes and executes a python script to do it.

▲

j16sdiz 9 hours ago | parent [-]

breaking a chroot takes more than that..

	▲	hoppp an hour ago \| parent [-]
		That doesn't mean claude can't do it, chroot is better than nothing but not a real solution