Looking at how Opus 5.5 works, i completely believe the "ai escaped their boxes to hack sth" stories.
When claude felt the need to do do sth on a server, instead of just asking me, it would:
- leave its "sandbox" (whatever that means)
- connect to my other machine
- from there, ssh into a server
- to get a Forge token from a projects .env
- to use that token to create Forge recipes to run commands on the target server
🤷
Now every connection, every non-harmless cli call needs 1PW or Yubikey approval.
commit 30c1c46