{"version":"2.1.277","anchor":"new-sandbox-escape-detection-heuristics-for-sandboxexclude","canonical_anchor":"new-sandbox-escape-detection-heuristics-for-sandboxexclude","heading":"New sandbox-escape detection heuristics for sandbox.excludedCommands","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277\/e\/new-sandbox-escape-detection-heuristics-for-sandboxexclude","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.277","markdown":"### New sandbox-escape detection heuristics for `sandbox.excludedCommands`\n\nNew heuristics detect commands trying to escape the sandbox via the excludedCommands allowlist\n\n**What**\n\n`sandbox.excludedCommands` lets you name commands that always run outside the sandbox. Claude Code now parses the actual command line more carefully to catch cases where a command, or a wrapper around it, technically matches an allowlisted entry but is actually being used to slip past the sandbox. It recognizes things like:\n\n- Trusted versus untrusted uses of `env`\n\n- Dangerous interpreter or shell flags, such as `-c`, `--eval`, `-e`, or PowerShell's `-command`\/`-encodedcommand`, across dozens of tools including bash, python, perl, ruby, php, node, git, docker, kubectl, aws, and pwsh\n\n- Tricks involving `IFS` or positional parameters\n\n- Risky glob expansion\n\n- Git subcommands that can read or write outside the repository, such as `clone`, `worktree add`, `bundle create`, and `config` changes to dangerous keys like `core.sshcommand` or `core.hookspath`\n\n**Why**\n\nThis closes off ways a command could use an excludedCommands entry as a loophole to run unsandboxed code that reaches beyond what was intended, building on earlier work that tied the exclusion list to whether unsandboxed commands are allowed at all.\n\n- Area: Sandbox\n- Names: `sandbox.excludedCommands`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}