FreeResource

The guardrail bypass checklist.

Where Claude Code, Codex and Cursor guardrails stop, in each vendor's own words, plus 13 public bug reports filed since August 2026. Test each item against your own config.

Last checked Nov 4, 2026. Each item links the doc it comes from.

Claude Code.

  1. Bash rules match text

    Bash permission rules match the command string, so the docs call them no security boundary. Bash(curl *) leaves /usr/bin/curl and sh -c 'curl ...' open, and Bash(git push *) leaves git -C . push open. Source

    Test: run each variant against your deny list.

  2. Read and Edit rules cover built-in tools

    Deny rules for Read and Edit leave grep -r and scripts that open files on their own. The sandbox covers those. Source

  3. Saved approvals land in a local file

    Choosing "don't ask again" writes the rule to .claude/settings.local.json. Source

    Test: review that file for broad allow rules.

  4. Hooks proceed on failure by default

    On most events a failed or timed-out hook lets the action go ahead. Exit code 2 blocks. "onFailure": "block" needs v2.1.295 or later. Source

  5. Sandbox allowlists need care

    Broad domains such as github.com allow data exfiltration and domain fronting. allowUnixSockets can expose docker.sock. Write access to PATH folders or .bashrc can lead to privilege escalation. Use filesystem and network isolation together. Source

Codex.

  1. Network is off in workspace-write

    sandbox_workspace_write.network_access turns it on. Domain rules apply only with network_proxy enabled, and deny wins over allow. Source Source

  2. Some paths stay read-only

    .git, .agents, .codex and .aws are protected. danger-full-access and --dangerously-bypass-approvals-and-sandbox (--yolo) remove the protections. Source

  3. Rules see whole scripts

    bash -lc scripts with redirects, $(), environment variables, wildcards or control flow are not split into commands, so a rule applies to the whole invocation. Order is forbidden, then prompt, then allow. Source

  4. Escalations skip the proxy

    An approved full sandbox escalation can run outside the managed command proxy. dangerously_allow_all_unix_sockets is flagged as risky. Source

Cursor.

  1. Run modes are best effort

    Cursor calls run modes "best-effort guardrails rather than a hard security boundary". MCP tool calls ask for approval. Source

  2. Auto-review can rerun outside the sandbox

    "Auto-review is not a security boundary." A command that fails in the sandbox can rerun outside it after classifier review. Source

  3. Default network list is broad

    sandbox.json lives in ~/.cursor or .cursor. Network policy defaults to deny and deny beats allow, but the default mode adds built-in domains such as github.com, google.com and *.googleapis.com. Type insecure_none turns the sandbox off. Source

  4. Workspace trust starts off

    Turn it on before opening repos you do not control. Source

13 public reports.

Guardrail bugs filed on GitHub between Aug 13 and Oct 27, 2026. These are user reports; status reflects GitHub on Nov 4, 2026, and vendor confirmation is Unverified.

FiledAgentReportStatus
Aug 22Claude Code#88770 permissions.deny rule Bash(curl *) bypassed under Auto ModeOpen
Aug 22Claude Code#88891 Custom autoMode hard_deny and soft_deny load but are not enforcedOpen
Aug 13Claude Code#86253 Managed disableBypassPermissionsMode does not block --dangerously-skip-permissionsClosed
Sep 30Claude Code#98376 hooks key in managed-settings.json ignoredOpen
Sep 23Claude Code#96408 allowedMcpServers not enforced when the settings fetch is slowOpen
Oct 27Claude Code#105470 Empty remote settings cache revalidated with 304 indefinitelyOpen
Oct 18Claude Code#103241 Read deny bypassed through command substitution, subshells, source and interpretersOpen
Sep 14Claude Code#94362 PreToolUse hook without the exec bit fails openOpen
Oct 21Claude Code#103909 Cloud Projects ignore the repo .claude config since 2.1.306Open
Oct 14Claude Code#102136 Permission prompt defaults to Always allowOpen
Aug 21Codex#39973 Retiring approval_policy untrusted weakens the approval boundaryOpen
Aug 21Codex#39872 TUI bash deny not enforced; apply_patch deny can be bypassedOpen
Oct 4Codex#50807 Codex Web Ask for approval escalation runs without a promptOpen

Run this checklist on every release.

denyproof probes your guardrails after each agent update and flags any rule that moves.

Get early access

Sources.

  1. Claude Code: Permissions
  2. Claude Code: Sandboxing
  3. Claude Code: Hooks
  4. Codex: Agent approvals and security
  5. Codex: Sandboxing
  6. Codex: Rules
  7. Cursor: Agent security
  8. Cursor: Run modes
  9. Cursor: Sandbox reference
  10. Issue links in the table above, on github.com.