Secure AI Coding Agents: 3-Step Permission Sandbox for Claude Code/Codex

Tutorial Objectives

Add a permission sandbox to your commonly used AI programming agents (Claude Code, Codex CLI, Cursor) in 15 minutes - preventing AI from unknowingly bypassing system restrictions and performing dangerous operations.

Why do we need a sandbox?

In June 2026, a developer shared a thrilling experience on HN: Codex "creatively" found a way to bypass restrictions on a machine without sudo permissions - it discovered a legacy setuid binary, through which it indirectly performed operations that required privilege escalation (382 points, 184 comments).

This is not a problem with Codex and is a common feature of all AI programming agents: they are trained to "get the job done" and actively search for alternative paths when encountering permission obstacles. Today, when AI is given full terminal access, sandboxing is no longer optional but standard.

What you will learn

• 3 progressive sandbox solutions (from lightweight to enterprise level)
• Specific commands and configurations for each scenario
• How to ensure safety without sacrificing efficiency

Overall architecture

Step 1: File system permission restrictions (L1, 5 minutes)

The most lightweight solution, no additional software required, suitable for daily use.

Principle

When the AI Agent is running, it can only access the specified directory and cannot read or modify files outside the project. Achieved via dedicated user + directory permissions.

Specific operations

# 1.
sudo useradd -m -s /bin/bash aiagent

# 2.
sudo mkdir -p /opt/ai-projects/my-project
sudo chown aiagent:aiagent /opt/ai-projects/my-project

# 3. Agent
sudo -u aiagent claude

Claude Code， .claude/settings.json

{
  "permissions": {
    "allow": ["/opt/ai-projects/**"],
    "deny": ["/etc/**", "/home/**", "/root/**"],
    "requireApproval": ["sudo", "rm -rf", "chmod 777"]
  }
}

Claude Code ，。

2 Docker （L2，10 ）

Docker ——Agent ，。

Agent

FROM ubuntu:24.04
RUN apt-get update && apt-get install -y git curl build-essential
RUN useradd -m agent && usermod -aG sudo agent
USER agent
WORKDIR /workspace

docker build -t ai-agent-sandbox .

docker run -it --rm \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=2G \
  --tmpfs /workspace:rw,noexec,nosuid,size=5G \
  -v "$(pwd):/workspace/project:ro" \
  --cap-drop=ALL \
  --cap-add=DAC_OVERRIDE \
  --memory=4g \
  --cpus=2 \
  ai-agent-sandbox

3 Firejail + （L3，15 ）

—— Firejail 。

Firejail

# macOS
brew install firejail

# Linux
sudo apt install firejail

Claude Code

# /etc/firejail/claude-code.profile
include /etc/firejail/default.profile
net none
private-tmp
private-dev
read-only ~/.ssh
blacklist ~/.aws
blacklist ~/.config/gcloud
whitelist ~/projects

Firejail Agent

firejail --profile=claude-code.profile claude

.ai-security-rules.yaml

rules:
  - pattern: "rm -rf"
    require_approval: true
    approvers: ["tech-lead"]
  - pattern: "git push.*main|master"
    require_approval: true
  - pattern: "curl.*\\|.*sh"
    require_approval: true
 message: " curl pipe bash "
  - pattern: "pip install|npm install -g"
    require_approval: true

Q1 Agent ？

，。（ net none）、、Git 。

Q2Docker Firejail ？

Docker（）， Firejail（， Git ）。 AI Agent，Docker —— Agent 。

Q3M4 Mac Docker ？

Apple Silicon Docker ARM，AI Agent I/O 。（ API ）。

Claude Code、Codex CLI、Cursor、Docker、Firejail.

Next action

• Want to know the value of Claude Code’s security research? → Security researcher uses Claude Code for vulnerability mining: a real case of monthly income $10,000
• Still haven't decided which Agent to use? → How to choose AI programming Agent? Three-dimensional comparison of language, model and cost.
• Want to make your automated workflow more reliable? → How to add quality gates to your AI automation workflow: A practical guide from output to trustworthy results