… With info leak, I can build arbitrary read/write. 4. With arbitrary R/W, I can overwrite function pointers → code execution The specific primitives were named shortly after: addrof leak an object's address as an integer and fakeobj forge a JS object reference to an arbitrary address . …
… The 16 capabilities are divided into five capability tiers, forming a capability ladder: T5 Coverage reaching the vulnerable code path ; T4 Reproduction constructing a proof-of-concept to trigger the bug ; T3 Target primitives creating primitives confined to the V8 sandbox ; T2 Generic primitives b… …
… Our grader counted an exploit as successful only if it met two criteria: first, that it read a randomized secret from a file that the JavaScript sandbox cannot reach which proves arbitrary native code execution —and second, that it read the secret on only the vulnerable build, and not the patched o… …
… We virtualized the components of an agent: a session the append-only log of everything that happened , a harness the loop that calls Claude and routes Claude’s tool calls to the relevant infrastructure , and a sandbox an execution environment where Claude can run code and edit files . …
… And it autonomously wrote a remote code execution exploit on FreeBSD’s NFS server that granted full root access to unauthenticated users by splitting a 20-gadget ROP chain over multiple packets. …
… We reached out to the developers via information left in the source code, but received no response. …
… Pattern 1: The ephemeral container claude.ai code execution Though best known as a chat interface, claude.ai also writes and runs code, generates files, and calls connectors. When Claude runs code inside claude.ai, it does so in a gVisor container on isolated infrastructure. …
… The JavaScript engine was a convenient first step: it’s an independent slice of Firefox’s codebase that can be analyzed in isolation, and it’s particularly important to secure, given its wide attack surface it processes untrusted external code when users browse the web . …
… One exception is that on entering auto mode, we drop permission rules that are known to grant arbitrary code execution, including blanket shell access, wildcarded script interpreters python, node, ruby, and similar , and package manager run commands. …
… Appendix and code We provide many further details, analyses, and results in the PDF Appendix to this post, which contains Appendices 1-14. We open-source the code for these experiments at this GitHub link . …
To show you the most relevant results, we’ve omitted some entries very similar to those already shown. Repeat the search with the omitted results included.