The filtering done by auto mode (generally) catches accidental prompt injection, but isn't effective against actual attacks: https://embracethered.com/blog/posts/2026/breaking-claude-co...

(Anthropic themselves acknowledges this; see the end of the post.)

▲

zingar 3 hours ago | parent [-]

What are the sandboxing / isolation options that would protect against attacks like this?

▲

juliie 3 hours ago | parent | next [-]

Running Claude code in an isolated, temporary VM, with no access to memory is a good start. You give it your repo, prompt and you get back PRs. Claude code on web is a convenient way to do that.

▲

hoppp 2 hours ago | parent | prev | next [-]

I configured remote VPS and cloudflare sandboxes to run my agents.

▲

Uehreka 3 hours ago | parent | prev [-]

Who says that such options necessarily need to exist?

	▲	malfist 2 hours ago \| parent [-]
		Your employer worried about exfiltration