1
00:00:00,099 --> 00:00:01,639
So, you are in the zone, right?

2
00:00:02,240 --> 00:00:06,859
You clone this new open source repo to
audit it, you spin up Claude Code to help

3
00:00:06,899 --> 00:00:11,719
you, and boom, some hidden malicious
prompt injection in a test file triggers a

4
00:00:11,759 --> 00:00:15,159
command to upload your dot env secrets to
some random IP.

5
00:00:15,839 --> 00:00:18,299
And because you are clicking through
prompts to get your work done,

6
00:00:18,420 --> 00:00:20,219
you, uh, you just hit Enter.

7
00:00:20,699 --> 00:00:21,379
You approve it.

8
00:00:21,939 --> 00:00:27,019
It is what we call terminal prompt
fatigue, and honestly, it is a massive security

9
00:00:27,079 --> 00:00:28,359
disaster waiting to happen.

10
00:00:29,001 --> 00:00:29,881
Oh, absolutely.

11
00:00:30,081 --> 00:00:33,841
When you are in that flow state, you just
want the tool to do its thing.

12
00:00:34,361 --> 00:00:37,922
You are not reading every single network
permission pop up.

13
00:00:38,321 --> 00:00:41,601
It is like agreeing to terms of service,
you just click yes.

14
00:00:42,201 --> 00:00:47,021
And that is exactly why relying on
developers to manually catch malicious curl

15
00:00:47,101 --> 00:00:49,542
commands in the moment is a losing game.

16
00:00:50,181 --> 00:00:55,001
By the way, today's episode is sponsored
by Jellypod AI, the absolute best tool for

17
00:00:55,061 --> 00:00:59,201
turning your daily newsletters and feeds
into personalized audio podcasts,

18
00:00:59,561 --> 00:01:02,341
so you can catch up on tech news like this
while on the go.

19
00:01:02,961 --> 00:01:04,501
But, Lachlan, back to the sandbox.

20
00:01:04,841 --> 00:01:08,021
How do we actually stop this fatigue from
compromising our keys?

21
00:01:08,042 --> 00:01:13,882
Right, so in the Claude Code release,
version 2.1.219, they introduced this awesome

22
00:01:13,962 --> 00:01:15,482
fail closed feature.

23
00:01:15,615 --> 00:01:20,762
It is a new configuration setting called
sandbox dot network dot strict Allowlist.

24
00:01:20,862 --> 00:01:25,002
And when you flip this boolean to true,
the whole mental model shifts.

25
00:01:25,082 --> 00:01:29,722
Instead of Claude Code stopping to ask
you, hey, should I let this command talk to

26
00:01:29,754 --> 00:01:34,682
this domain, it just silently blocks any
domain that is not explicitly pre approved.

27
00:01:34,869 --> 00:01:38,842
No prompts, no fatigue, just an immediate
shut door.

28
00:01:39,052 --> 00:01:39,412
Yes!

29
00:01:39,852 --> 00:01:42,632
Fail closed is exactly what we need here.

30
00:01:42,712 --> 00:01:45,273
So, how do we actually write this
configuration?

31
00:01:45,732 --> 00:01:46,952
What does the JSON look like?

32
00:01:47,000 --> 00:01:47,960
It is super simple.

33
00:01:48,100 --> 00:01:53,080
You can set it globally or drop it right
into your project's local dot claudecode

34
00:01:53,120 --> 00:01:55,160
slash settings dot json file.

35
00:01:55,280 --> 00:01:59,000
You just open up the sandbox object, then
nesting inside that,

36
00:01:59,020 --> 00:02:02,760
you go to network, and then you set strict
Allowlist to true.

37
00:02:02,900 --> 00:02:06,200
And right next to that, you define your
allowed Domains array.

38
00:02:06,360 --> 00:02:11,160
So, if you only want it touching GitHub,
you just add github dot com to that list,

39
00:02:11,200 --> 00:02:12,680
and nothing else gets through.

40
00:02:12,766 --> 00:02:16,647
Okay, but I can already hear the
developers screaming because their build pipelines

41
00:02:16,667 --> 00:02:17,786
are going to break.

42
00:02:17,826 --> 00:02:23,146
If you turn this on, and Claude tries to
run, say, npm install or pip install,

43
00:02:23,627 --> 00:02:26,246
and those domains are not on your
allowlist, what happens?

44
00:02:27,229 --> 00:02:29,369
Oh, it is a total silent wall.

45
00:02:30,250 --> 00:02:34,449
You will get these super cryptic
connection timeout errors or DNS failures,

46
00:02:34,989 --> 00:02:38,630
and you will be scratching your head
wondering why your unit tests or package

47
00:02:38,710 --> 00:02:40,029
managers are suddenly failing.

48
00:02:40,729 --> 00:02:45,409
So, the trick is, before you run your
agent tasks, you have to preemptively build a

49
00:02:45,469 --> 00:02:48,069
checklist of the actual registry
endpoints.

50
00:02:48,689 --> 00:02:53,489
We are talking registry dot npmjs dot org,
or pypi dot org,

51
00:02:53,569 --> 00:02:56,889
or even your internal enterprise ones like
JFrog Artifactory.

52
00:02:57,590 --> 00:03:01,849
If they are not in that allowed Domains
list, your builds will just grind to a halt.

53
00:03:02,219 --> 00:03:06,179
Right, so you have to be really
disciplined about defining those up front.

54
00:03:06,659 --> 00:03:08,519
But let me push on the security side of
this.

55
00:03:09,159 --> 00:03:11,719
How secure is this sandbox proxy under the
hood?

56
00:03:12,199 --> 00:03:14,679
Like, how is it actually enforcing these
domain limits?

57
00:03:14,708 --> 00:03:16,228
Well, this is where it gets interesting.

58
00:03:16,368 --> 00:03:22,068
The built in sandbox proxy inspects the
unencrypted Server Name Indication header,

59
00:03:22,108 --> 00:03:24,628
the SNI, in the TLS handshake.

60
00:03:24,761 --> 00:03:28,628
It does this without decrypting or
terminating the actual traffic.

61
00:03:28,728 --> 00:03:33,268
But, because it is just looking at the
SNI, a really clever attacker could use

62
00:03:33,325 --> 00:03:34,468
domain fronting.

63
00:03:34,548 --> 00:03:39,108
They put an allowed domain in the SNI
header, but then send the actual request to a

64
00:03:39,152 --> 00:03:42,868
completely different malicious server once
the connection is established.

65
00:03:43,314 --> 00:03:43,995
Oh, wow.

66
00:03:44,414 --> 00:03:48,275
So the sandbox thinks it is talking to,
say, github dot com,

67
00:03:48,775 --> 00:03:52,274
but the traffic is actually routed to a
malicious endpoint?

68
00:03:52,354 --> 00:03:55,295
That is a pretty significant loophole for
high security environments.

69
00:03:55,494 --> 00:03:56,154
Exactly.

70
00:03:57,054 --> 00:04:01,914
If you are in a hardened enterprise setup,
you cannot just rely on the default SNI

71
00:04:01,974 --> 00:04:02,794
inspection.

72
00:04:02,855 --> 00:04:07,355
You need to close that final gap by
routing all of your Claude Code traffic through

73
00:04:07,375 --> 00:04:12,375
your own corporate forward proxy that does
full TLS decryption and inspection,

74
00:04:12,795 --> 00:04:14,914
using your own corporate Certificate
Authority.

75
00:04:15,234 --> 00:04:19,574
That way, you are inspecting the actual
packets, not just the handshake wrapper.

76
00:04:19,744 --> 00:04:20,865
That makes total sense.

77
00:04:21,224 --> 00:04:25,704
Prevent the prompt fatigue with strict
allowlists, but back it up with real proxy

78
00:04:25,784 --> 00:04:28,085
controls if you are protecting the crown
jewels.

79
00:04:28,644 --> 00:04:29,564
Good stuff, Lachlan.

80
00:04:29,885 --> 00:04:33,244
Thanks for walking us through version
2.1.219.

81
00:04:33,564 --> 00:04:34,144
Catch you next time.

82
00:04:34,167 --> 00:04:34,887
No worries, mate.

83
00:04:34,919 --> 00:04:35,447
Talk soon.