We're partnering with @huggingface to investigate an unprecedented security incident. Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation. Sharing preliminary findings to help defenders understand emerging risks:

# Claude Code Features and Practical Usage 🔒 Control exactly how autonomously Claude operates. Read-only for untrusted investigation, auto-approve in trusted environments: safety and speed at once. 📌 Title and Feature URL Title: Permissions / Sandbox URL: 📝 Overview Claude Code provides a fine-grained permission system so you can specify exactly what the agent may and may not do. Combine allow/ask/deny rules with permission modes, check the config into version control, and distribute the same guardrails to your whole team. A sandbox adds OS-level isolation on top. 🔧 How It Works - A tiered model: read-only tools (file reads, Grep) need no approval; Bash commands and file edits require approval. - Rules evaluate in order: deny, then ask, then allow. The first match wins. A deny at any scope takes precedence and cannot be overridden by an allow. - Permission modes include default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. plan only reads and runs read-only commands; bypassPermissions is nearly all-permissive and risky. - Rules are enforced by Claude Code, not the model. Prompt or CLAUDE.md instructions shape what Claude tries, not what it is allowed to do. 🛠 Practical Usage - During a session, use "/permissions" to view and edit all rules and the settings.json they come from. - Rule syntax is "Tool" or "Tool(specifier)". Examples: Bash(npm run build), Read(./.env), WebFetch(domain: Bash supports glob "*". - Configure in settings.json under permissions.allow / deny. Example: allow "Bash(npm run *)", deny "Bash(git push *)" and "Read(./.env)". - For read-only investigation, use plan mode, or deny "Edit" and "Write" and narrow Bash. Control subagents with rules like Agent(Explore). - Grant extra directory access via "--add-dir" or "/add-dir", and persist it with additionalDirectories. 🎯 Use Cases - Investigate an untrusted repo in plan mode to understand structure without modifying source. - Define safe allow/deny in a shared .claude/settings.json so everyone gets the same guardrails. - Inside a container or VM, use bypassPermissions to skip prompts and speed up CI or bulk work. - Restrict where Bash can reach using the sandbox's ⚠️ Caveats - bypassPermissions skips prompts even for writes to .git and .claude, so only use it in isolated environments (rm -rf / still stops as a circuit breaker). - Argument-constraining curl permission patterns are fragile. It is more reliable to deny Bash network tools and allow specific WebFetch(domain:...) entries. - Read/Edit deny rules apply to built-in file tools and recognized Bash commands only, not to files a Python or Node script opens directly. Use the sandbox to bind all processes. - Managed settings cannot be overridden by any other scope; enforce organizational policy there. #ClaudeCode# #DevTools#