> harness ... a privilege boundary around the agent

They don't really do that though. If you want something sandboxed you actually have to sandbox it, not plead with the LLM to please sandbox itself. A VM can be configured to do the former, harnesses do the latter.

▲

ls612 an hour ago | parent [-]

If you say in your CLAUDE.MD that a certain directory is read only inputs, Claude Code will actually enforce that and deny any write to that directory by the agent. To name just one example.

	▲	27183 an hour ago \| parent [-]
		...maybe. If there are any actual consequences if that software's invariants are violated you're better off using an external sandboxing mechanism. There are many excellent quality, battle tested options to choose from that you can actually rely on. Trusting claude code for this is highly questionable behavior for an organization, and would really throw the rest of their security posture into doubt IMO. Like if I learned a company was letting clod play in the same sandbox as developers' ssh keys, vpn certs, etc I'd take steps to make sure my organization absolutely never uses their software.