AI
The Workspace Trust Boundary Is Leaky
When a CLI agent launches, the current working directory becomes its trust boundary. Gemini CLI checks file paths with a prefix match. Claude Code had CVEs for both prefix matching and symbol link bypass. A symbol link tricks the agent into accessing files outside the workspace. Guan reported three such bypasses in Gemini CLI. The shell tool does not enforce CWD at all. Read file blocked a cat to /etc/passwd but cat via shell tool passed without approval. That gap is fundamental.
Shell Parsing: A Nine-Month Whack-a-Mole
Gemini CLI 0.1.8 used 115 lines of shell parsing. A semicolon injection could bypass it. Version 0.1.8 added detection of command substitution but missed process substitution (reported by Guan, fixed). Google moved to tree-sitter, a true bash parser used by VS Code, three months later. Even then, the time command bug persisted until February 2026 (version 0.2.29). Tree-sitter trusted the time command but ignored the actual command after it. Claude Code saw 9 different bypass CVEs in a whack-a-mole pattern. Each new defense creates a new edge case for attackers.
Sandboxes: Not a Silver Bullet
Zhengyu Liu argued that sandboxing the entire shell execution is a better layer than parsing. Claude Code uses seatbelt on macOS and bubblewrap plus seccomp on Linux, enabled by default. Gemini CLI disables sandbox by default but auto-enables in yolo mode. Cloud Code also defaults off. Liu found a sandbox bug in Claude Code’s runtime library: passing an empty allowed domains array allowed all outbound connections instead of blocking them. Another attack creates a malicious settings.json inside the sandbox that persists after the session. The sandbox cannot protect files that control the next session.
MCP Servers and Skills: New Attack Surfaces
MCP servers and agent skills extend the agent’s capabilities but bypass the sandbox. An MCP server is a pre-existing process; the sandbox has no jurisdiction over it. The file system MCP server had CVEs for symbol link and path prefix bypass. GitHub MCP server had argument injection and path traversal. Memory MCP allowed arbitrary JSON file writes via loose schema checks. Skills installation in Gemini CLI had a zip slip: the bundle format trusts the stored path, allowing overwrite, enabling overwrite of VS Code settings.json. A demo showed a skill with a path traversal name that, after install, injected a command executed on terminal launch.
What Today Should Look Like
Guan and Liu offered four recommendations. Do not use yolo mode in production; always keep human approval for critical repos. Audit context files: agent.md, markdown, and config files are embedded as system prompt and can be poisoned. Verify commands at runtime: if you cannot parse a command at a glance, do not run it. Enable sandbox by default and adjust its policy to your setup. They noted that prompt injection leading to command injection is an endless game. Each new attack surface creates new edge cases. The goal is auditable and transparent agents with secure-by-default modes.
Q&A
Are those system prompts verified or just what the LLM thinks? Guan said they are embedded directly from workspace files by the software at boot time. ▶ 42:21
Could one LLM review the commands issued by the main LLM before execution? Liu noted Claude Code already uses a Haiku model to detect root commands when tree-sitter fails. ▶ 42:59
You advise against yolo mode, but what do you use for personal projects to move fast? Guan said he never uses yolo mode; treats it carefully and especially avoids it in autonomous workflows. ▶ 44:42
Notable Quotes
so the cat doesn’t check the current working directory the read file does Aonan Guan · ▶ 9:49
every new defense creates a new edge edge case that can be exploited Aonan Guan · ▶ 15:20
cloud code alone had 22 cases in 10 months and 19 of them are rated as high Zhengyu Liu · ▶ 26:41
Key Takeaways
- Shell command parsing is a losing game; sandboxing is necessary but not sufficient.
- MCP servers and skills bypass agent sandbox, reintroducing classic injection bugs.
- Always keep human approval and audit workspace files; never trust yolo history alone.
About the Speaker(s)
Aonan Guan is Lead Cloud at Wyze Labs. He discovered vulnerabilities in Google Gemini CLI, Anthropic Claude Code, Anthropic MCP Servers, Microsoft Azure, GitHub Copilot, Vercel Next.js. His research has been featured in The Hacker News, The Verge, and international media.
Zhengyu Liu is a Ph.D. student in Computer Science at Johns Hopkins University, advised by Prof. Yinzhi Cao. His research focuses on Web Security and Software Security, leveraging program analysis and machine learning to automatically detect and exploit vulnerabilities.