TLDR Tech / InfoSec
AI Coding Tools in a Sandbox: Why Your File System Needs Protection
AI coding tools like Claude Code, Copilot, and Cursor run with full user-level filesystem permissions, meaning a hallucinated path or misinterpreted command can expose SSH keys, credentials, and sensitive files outside the project directory. bx wraps any AI coding tool using macOS's kernel-level sandbox-exec to restrict filesystem visibility to the target project directory only, with a .bxignore file allowing per-project exclusion of .env files, certificates, and secrets even within the allowed path. Enforcement occurs at the OS kernel before any process can act, so the protection covers not just direct file operations but also MCP server calls, shell commands, and automated hooks that would otherwise execute with the user's full permissions.
Read the full story