Just one of the many reasons why I run my agents sandboxed (and why I wrote agent sandboxing software).
I once caught my Claude agent complaining that it couldn't connect to https://some-weird-domain.com because the network was down (I disable network in the sandbox when it doesn't need it, and broker the API connection). I asked why it was looking there and it told me I'd asked it to.
I never found any evidence of prompt injection, but it sure as hell made me paranoid.
For someone that's used to the convenience of leaving claude code running unattended in auto mode, how would you recommend I change my setup so that agents are sandboxed? Looking for something that's safer than unsandboxed auto mode but just as convenient, or at least very close to as convenient.
Claude Code has a built in sandbox for terminal commands which is very simple to enable, if nothing else: https://code.claude.com/docs/en/sandboxing
Sometimes they get confused between their own output and user messages…