22. Execution Risk and Isolation (What Holds and What Fails)
Show notes
In Episode 22 of Beyond Prompting, author Sho Shimoda addresses the security accounting of autonomous AI agents. An agent that generates text can only be wrong; an agent that executes commands can be wrong in ways that persist after the conversation ends. In this episode, we break down:
- Four Core Execution Risks: Analyzing command injection from interpolated content, destructive file operations across unexpected path scopes (such as rm -rf "$DIR"/*), prompt injection via hostile untrusted files, and unauthorized data exposure.
- Boundaries Across the Three Surfaces: Comparing Chat (reaches nothing), Cowork (ephemeral cloud sandboxes with a desktop app broker), and Claude Code (runs directly on your host machine with an OS-enforced shell boundary).
- What the OS Sandbox Actually Enforces: How Seatbelt (macOS) and bubblewrap (Linux/WSL2) constrain shell commands at the OS level—holding even if prompt injection bypasses model decision-making—while recognizing what sits outside it (file tools, MCP servers, and hooks).
- Handling Prompt Injection Structurally: Why prompts are not security boundaries, and why defending against prompt injection requires a three-layer structural strategy: scoping permissions, constraining shell reach via the sandbox, and explicitly denying access to credential paths (~/.ssh, ~/.aws).
- Constraining Damage vs. Guaranteeing Safety: Internalizing the foundational rule of agent security: "The sandbox constrains the scope of damage. It does not make operations safe."
(Note for listeners: This episode covers Chapter 22 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).