Permission prompts vs. unsafe auto-approve (sandboxing)

Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.

thehours · Oct 22, 2026 · comment in “OpenShell – A safe, private runtime for fleets of autonomous AI agents”

It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)

Maxpowerfreak · Oct 15, 2026 · comment in “OpenCode 2.0”

You install an update. Oops, they added a sandbox that doesn't work inside a docker container, it's stopped working.

michaelt · Oct 12, 2026 · comment in “Codex CLI installs a persistent, self-updating background daemon by default”

- fine-grained context control by default - I have to disable a bunch of stuff in codex so it doesn't pollute my context with generated memories - I find that OpenAI model sometimes struggle to navigate codex' sandboxing, and burn a bunch of tool calls retrying outside the sandbox when the sandboxed command fails

darklinear · Oct 1, 2026 · comment in “Pi 1.0”

The problem is absolutely that the LLM doesn't know how to program (or anything else for that matter). It's why they are ineffective tools - either you YOLO them and get buggy software, or you check up on them and it takes just as long as it did before.

bigstrat2003 · Sep 29, 2026 · comment in “Coding is not solved”

So claude has been an alias to `claude --dangerously-skip-permissions`, and codex has had `approvals_reviewer = "auto_review"`, for about a year now. Anybody else just gave up on coping with broken permission management in their agent?

meredithbloom · Sep 26, 2026 · story in “AI: Who Still Uses Permissions?”

* agent has no way to _request_ unsandboxed execution (e.g. if `kubectl whatever` is rejected by the sandbox, the model should have the chance to request permission) * does not understand shell composition patterns (e.g. if `git status` is allowed and `git log` is allowed, then `git status && git log` should be allowed automatically)

ngruhn · Sep 21, 2026 · comment in “AX – Google’s Open Agentic Orchestrator”

Imagine at Adobe they wake up after the tokenmaxxing shock, to find they blasted through their whole 200 Mil AIds budget for the year in the first month. Would be a shame if another company’s AI breached their sandbox and manipulated the ad campaign because it hallucinated its actually an OpenAI product and AIdsmaxxing.

Jamesbeam · Sep 16, 2026 · comment in “OpenAI expands ChatGPT ads with Sponsored Agents”

Gemini is great via the Chat interface and decent via Github Copilot. I honestly hate it via Antigravity CLI because their sandboxing system frankly doesn't work.

dudeinhawaii · Sep 3, 2026 · comment in “Gemini 3.8 Flash and 3.8 Flash Cyber”

I use Claude Code (both Desktop and CLI) all day every day (as well as OpenCode with DeepSeek V4 among others). For non-mission-critical stuff (small internal tools, anything that doesn't touch the client and doesn't handle critical data or infra), I'm on Auto (sandboxed in the working directory).

dexterlagan · Aug 29, 2026 · comment in “Our decision on Cursor following its acquisition by SpaceX”

I managed to get the sandbox working, and the option to break out of sandbox (with approval). The network sandboxing doesn't work yet (I don't want malicious script to be execute and exfiltrate the data), I created an issue here: https://github.com/erichll/pi-packages/issues/1 - might submit a PR once I get a reply.

ptgamr · Aug 17, 2026 · comment in “Pi's Minimalism Is Its Advantage”

incus launch ubuntu-claude my-claude-vm incus exec my-claude-vm -- claude -p "solve the EC discrete logarithm problem, if it doesn't work keep going" --dangerously-skip-permissions

Grimburger · Aug 10, 2026 · comment in “Docker Sandboxes – Disposable, isolated sandboxes for AI agents”

Currently, I don't allow the agent access to docker, start docker myself, and then do short-lived sandbox-free sessions when the agent needs to do things that interact directly with docker; but that's annoying.

llimllib · Aug 10, 2026 · comment in “Docker Sandboxes – Disposable, isolated sandboxes for AI agents”

Having good sandboxes is now a must IMO. But sbx is a bit annoying to use with OpenCode for instance (which has zero sandboxing by default, unlike codex CLI or Claude Code).

espadrine · Aug 10, 2026 · comment in “Docker Sandboxes – Disposable, isolated sandboxes for AI agents”

Reminds me of sandboxy - https://github.com/apple/containerization/tree/main/examples/sandboxy Also if your thing doesn't work with `pi` out of the box, then low effort

c0rruptbytes · Aug 10, 2026 · comment in “Docker Sandboxes – Disposable, isolated sandboxes for AI agents”

Rule of thumb: worktree for "don't let agents collide", container for "don't let an agent hurt the host". Most local setups only need the first, and people tend to reach for heavyweight sandboxing before they need it, then abandon it because it's painful.

krupkinmaxim · Aug 9, 2026 · comment in “OpenChamber: An Agentic Development Environment”

In the cases where you can deterministically block actions, with sandboxes and file permissions, that's better than relying on an LLM. But that doesn't work for all actions, as the OP shows.

tOOtl · Aug 7, 2026 · comment in “Humans missed 1 in 3 threats approving AI agent commands across 40k game runs”

All git config and hooks are not writable inside the sandbox. This can be somewhat frustrating as you have to run git config commands outside, but the tradeoff is worth it imo.

sbysb · Jul 30, 2026 · comment in “Git worktrees are not an isolation boundary for coding agents”

The ostensible major event here is that it broke out of its sandbox, but how are we supposed to interpret that? AI often misunderstands or doesn't strictly follow the orders you give it, so why is it such a big deal that it didn't follow the rules this time?

idontbelonghere · Jul 28, 2026 · comment in “Our position on open-weights models”

And it is never explicit, you learn about it after you get bitten by it. Claude Code has auto mode which is supposed to take over permission prompts but no, they had to couple that with “I will assume this is what the user wants” and made it unusable.

ayhanfuat · Jul 17, 2026 · comment in “Claude Code: Anatomy of a Misfeature”

Yeah docker Mac expirience is pretty bad especially the x86 is just painful, and to your comment (about security), it should not really matter in practice, in fact we used both, but goal really is to run secure sandboxes that are processes without performance impact.

rh94 · Jul 13, 2026 · comment in “Ask HN: What Are You Working On? (July 2026)”

I use a bunch of different coding agents but they always have annoying permission pop-ups or not the right kind of sandboxing.

trashburger · Jul 12, 2026 · comment in “Show HN: Agent-run – Run a coding agent in a sandboxed environment”

Sometimes, but nodejs or npm won't work properly without the headless chromium VM, and would need bypassing local file-access security-sandbox restrictions most normal system Web-browsers enforce by default.

Joel_Mckay · Jun 16, 2026 · comment in “A backdoor in a LinkedIn job offer”

A tool that creates sandboxes (docker, podman, orbstack, seatbelt, tart, containerd, kata, firecracker) and then sets up an agent (claude, codex, gemini, aider, opencode) inside it with max permissiveness (no annoying permission prompts).

kstenerud · Jun 14, 2026 · comment in “Ask HN: What are you working on? (June 2026)”

The tab completions are sometimes overeager and I wish I had more control over them, but at least I am not staring at "Thinking" all day. Having said that sometimes you have to monitor AI because, e.g., AGY CLI, often goes off the rails completely, including writing code outside of the "sandbox."

dr_kiszonka · May 31, 2026 · comment in “AI job grief: A psychological crisis hitting tech workers”

Local VMs are heavyweight but useful if you are sandboxing an entire IDE/GUI app like Cursor. With containers it's somewhat annoying to share local files - Distrobox helps with GUI apps and mounting the home directory but loses sandboxing.

shengpuerh · May 20, 2026 · comment in “Gemini CLI will stop working from June 18, 2026”

As luck would have it, I tried Antigravity for the first time a few days ago. It was a complete buggy mess - at one point I asked Gemini why it could not use the network despite having network access enabled in the sandbox settings, and it told me that although it had network access, it couldn't use mdnsresponder while running with the built-in sandbox.

No1 · May 20, 2026 · comment in “Gemini CLI will stop working from June 18, 2026”

I also have Pi in Zed via the ACP, but it does not work so well with some of the extensions, especially the lack of a built-in permission system is a problem, when YOLO-mode is the only mode :)

rsolva · May 18, 2026 · comment in “Access to frontier AI will soon be limited by economic and security constraints”

Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection. I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp

electricapps · Apr 28, 2026 · comment in “GitHub Actions is the weakest link”

That doesn't work from a Python sandbox, a curl-only environment, or inside an MCP tool.

AgentNews · Apr 25, 2026 · comment in “Show HN: Get an Ethereum wallet for your agent with one API call, no OAuth”

When I am using Claude or Codex without external sandboxing tools and just using the TUI, I spend a lot of time approving individual commands. When I was working that way, I found Codex's tendency to stop and ask me whether/how it should proceed extremely annoying.

pxc · Apr 16, 2026 · comment in “Claude Opus 4.7”

I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but for power users is infuriating at times.

jasonjei · Apr 10, 2026 · comment in “You can't trust macOS Privacy and Security settings”

agent-safehouse (https://agent-safehouse.dev) was my answer to this. I was using Docker containers for sandboxing but it was annoying at times, not so much for the performance hit (which wasn’t noticeable running in OrbStack) but various little papercuts like no shared clipboard, node_modules pulling in Linux binaries or macOS binaries depending on whether I ran npm install from inside the sandbox or my own shell, e…

lukebyear · Apr 8, 2026 · comment in “Slightly safer vibecoding by adopting old hacker habits”

Running automation pipelines with LangGraph agents that control real hardware (Raspberry Pi Pico W over USB HID) makes sandboxing non-negotiable. A rogue agent on a terminal is annoying, and sending the wrong HID commands to a device can brick it.

Chepko932 · Apr 8, 2026 · comment in “Rescuing old printers with an in-browser Linux VM bridged to WebUSB over USB/IP”

You can copy your claude credentials into the VM and run off that. Just beware that the subscription credentials file expires every half hour and then the agent tries to refresh which is annoying (especially if you have multiple sandboxed agents), so the better way is to get a long-running subscription API key (no extra cost for that) and just pass it in.

kstenerud · Apr 8, 2026 · comment in “Slightly safer vibecoding by adopting old hacker habits”

Can subagents work on multiple branchs at the sametime (in a sandbox or some other way)? This is a major pain atm with any IDE, they all fight over the same git cmd instance and make a mess out of it.

cfontes · Apr 6, 2026 · comment in “Show HN: Modo – I built an open-source alternative to Kiro, Cursor, and Windsurf”

It's pretty obvious from the compiler errors what you need to do each case, but I wasn't really in the mood for manually going through hundreds of source files. So I just stuck a locally running qwen coder in yolo mode into a container, forgot about it for a week, and came back to a compiling code base.

iminschoolrnlol · Mar 15, 2026 · comment in “I'm 60 years old. Claude Code killed a passion”

It's pretty obvious from the compiler errors what you need to do each case, but I wasn't really in the mood for manually going through hundreds of source files. So I just stuck a locally running qwen coder in yolo mode into a container, forgot about it for a week, and came back to a compiling code base.

finaard · Mar 15, 2026 · comment in “I'm 60 years old. Claude Code killed a passion”

https://github.com/kstenerud/yoloai I built this because I was tired of babysitting Claude Code through permission prompts.

kstenerud · Mar 12, 2026 · story in “Show HN: YoloAI: Sandboxed agent, no permission fatigue, diff/apply workflow”

The original point that sparked this sub-thread though is that AI is being overhyped. If actual vibe coding (YOLO it, never look at or understand the code, thus truly enabling non-technical folk to have revolutionary power and ability) doesn't work, then AI is yet just another tool in the toolbelt like any other developer life enhancing tech we've had so far, it's just a new form of IDE.

thewebguyd · Mar 6, 2026 · comment in “Labor market impacts of AI: A new measure and early evidence”

Show HN: OmniGlass – Executable AI screen snips with kernel-level sandboxing I kept running into the same annoying friction with Claude Desktop and Cursor: I’d snip a Python traceback, the AI would tell me to "run pip install pandas," and then I’d sit there and type it out myself.

goshtasb · Mar 2, 2026 · story in “Show HN: OmniGlass – Executable AI screen snips with kernel-level sandboxing”

MCP's Streamable HTTP with OAuth discovery is the best way to ship AI integration with your product nowadays. CLIs require sandboxing, doesn't handle auth in a standard way and it doesn't integrate to ChatGPT or Claude.

buremba · Mar 1, 2026 · comment in “When does MCP make sense vs CLI?”

Yeah you can sit there and manually approve every action it takes, but then how is any of this useful when you have to supervise it constantly? Even Anthropic say that this doesn't work because reviewing every action leads to exhaustion and rubber stamping.

cedws · Feb 27, 2026 · comment in “Building secure, scalable agent sandbox infrastructure”

Show HN: BreakMyAgent – Open-source red-teaming sandbox for LLM system prompts As a developer, I got tired of manually testing my AI agents and chatbots against the same prompt injections and jailbreaks every time I tweaked a system prompt.

breakmyagent · Feb 26, 2026 · story in “Show HN: BreakMyAgent – Open-source red-teaming sandbox for LLM system prompts”

Now it can all just be endless "hit" of success and nothing that makes me feel tired or annoyed. The reason I believe this is because I recently went through a really annoying battle with Claude trying to get it to stop being so strict with its sandbox.

OneMorePerson · Feb 24, 2026 · comment in “AI Added 'Basically Zero' to US Economic Growth Last Year, Goldman Sachs Says”

2/ Has anyone found a middle ground that doesn't require full container orchestration? 3/ For those who moved to proper sandboxes: was the management overhead actually as painful day-to-day as it sounds upfront?

NBenkovich · Feb 23, 2026 · comment in “Ask PH: Worktrees or isolated sandboxes for multi-agent AI workloads?”

Is Microsoft ever going to implement proper VS Code plugin sandboxing? There are so many good extensions I would like to use, but I hate the security implications of loading yet more unvetted code for a nice-to-have.

3eb7988a1663 · Feb 22, 2026 · comment in “Fresh File Explorer – VS Code extension for navigating recent work”

Show HN: Azazel – Lightweight eBPF-based malware analysis sandbox using Docker Hey HN, I got frustrated with heavy proprietary sandboxes for malware analysis, so I built my own.

mariocandela · Feb 14, 2026 · story in “Show HN: Azazel – Lightweight eBPF-based malware analysis sandbox using Docker”

> I am extremely out of touch with anti-LLM arguments 'Just pay out the arse and run models without a sandbox or in some annoying VM just to see them fail.

xyzsparetimexyz · Feb 10, 2026 · comment in “Eight more months of agents”

Every time I use Docker as a sandbox people warn me to watch out for "container escapes". I trust Firecracker more because it was built by AWS specifically to sandbox Lambdas, but it doesn't work on macOS and is pretty fiddly to run on Linux.

simonw · Feb 7, 2026 · comment in “Monty: A minimal, secure Python interpreter written in Rust for use by AI”

After setting it up securely for myself and a few friends, I started automating the whole process — automated provisioning on Hetzner with Docker sandbox, UFW, fail2ban, SSH key auth pre-configured. Turned it into a small managed hosting service (runclaw.ai) because I kept seeing the same setup struggles everywhere.

ArickVigas · Jan 31, 2026 · comment in “Clawdbot is a security nightmare [video]”

3. What’s the best pattern for “LLM as an unreliable subprocess” (retries, circuit breakers, sandboxing, determinism contracts)?

chenyusu · Jan 28, 2026 · story in “Notes on Clawbot: agents are starting to look like OS runtimes design now”

Hi HN, I built MMI (Mother May I?) with Claude Code to solve an annoying friction point: manually approving every single Bash command.

dgerlanc · Jan 22, 2026 · story in “Show HN: Mother May I? – Auto-approve safe Bash commands in Claude Code”

It's trivially easy to get Claude Code to go out of its sandbox using prompting alone. Side note: I wish Anthropic would open source claude code. filing an issue is like tossing toilet paper into the wind.

prodigycorp · Jan 20, 2026 · comment in “Running Claude Code dangerously (safely)”

What about GitHub trusted CI deploys? One frustrating thing about these solutions is that they’re great to prevent Claude from breaking a machine, but there’s no pervasive sandbox for third party services

gcr · Jan 20, 2026 · comment in “Running Claude Code dangerously (safely)”

I wouldn't say I have used it extensively, but so far my experience has been good. Only annoying part has been not able to use GPU in the Codex without using `--sandbox danger-full-access` flag.

mks_shuffle · Jan 7, 2026 · comment in “The creator of Claude Code's Claude setup”

Some of these don’t really seem like they bypassed any kind of sandbox. Like hallucinating an npm package.

joshribakoff · Dec 31, 2025 · comment in “Observed Agent Sandbox Bypasses”

The garbage collection, the forgiving syntax, the interpreted nature: these create a sandbox where vibe coded solutions can fail safely. A buggy Python script throws an exception.

Danborg · Dec 10, 2025 · comment in “If you're going to vibe code, why not do it in C?”

Coming soon (in active development): Python SDK, multi-agent coordination layer, OIDC/API-key auth middleware, and a VM-based compute sandbox. I hate how a lot of core features in products, like MCP servers with SaaS integrations are paywalled or not being able to self-host code that models your business processes (which is your IP!!) or needing to buy in to very custom DSL's that don't scale with your business...

solsol94 · Dec 2, 2025 · story in “Show HN: I built an open-source Rust/TS AI agent runtime with a Next.js-style DX”

Codex does such sandboxing, fwiw. In practice it gets pretty annoying when e.g. it wants to use the Go cli which uses a global module cache.

cube2222 · Dec 1, 2025 · comment in “Google Antigravity just deleted the contents of whole drive”