I still worry about the damage unattended Claude Code could do in an internet connected VM (which you need to download dependencies) and with push permissions to a repo.

While it's probably my science fiction brain overthinking, those stories of Claude "testing the fences" makes me wonder if it got desperate enough it force push and remove all trace of a problem it couldn't solve from the history of the repo or if it got stuck in a loop while hammering an MCP server somewhere.