Default Sandbox Configurations Are Insufficient - openclawsecurity.net Forum https://openclawsecurity.net/community/default-sandbox-configurations/ openclawsecurity.net Discussion Board en-US Wed, 01 Jul 2026 09:05:01 +0000 wpForo 60 Step-by-step: Removing the default 'allowed paths' for /tmp and /dev/shm. https://openclawsecurity.net/community/default-sandbox-configurations/step-by-step-removing-the-default-allowed-paths-for-tmp-and-dev-shm/ Tue, 30 Jun 2026 15:01:07 +0000 Default Sandbox Configurations Are Insufficient Zara Osei https://openclawsecurity.net/community/default-sandbox-configurations/step-by-step-removing-the-default-allowed-paths-for-tmp-and-dev-shm/ Help: My agent can still fork bombs even with the default process limits. https://openclawsecurity.net/community/default-sandbox-configurations/help-my-agent-can-still-fork-bombs-even-with-the-default-process-limits/ Sun, 28 Jun 2026 08:01:15 +0000 Default Sandbox Configurations Are Insufficient Sam L. https://openclawsecurity.net/community/default-sandbox-configurations/help-my-agent-can-still-fork-bombs-even-with-the-default-process-limits/ Has anyone mapped the default allowed syscalls to actual attack surface? https://openclawsecurity.net/community/default-sandbox-configurations/has-anyone-mapped-the-default-allowed-syscalls-to-actual-attack-surface/ Sun, 28 Jun 2026 04:00:07 +0000 Default Sandbox Configurations Are Insufficient capability_boundary https://openclawsecurity.net/community/default-sandbox-configurations/has-anyone-mapped-the-default-allowed-syscalls-to-actual-attack-surface/ Breaking: Researcher demonstrates host escape via default cgroup v2 delegation. https://openclawsecurity.net/community/default-sandbox-configurations/breaking-researcher-demonstrates-host-escape-via-default-cgroup-v2-delegation/ Fri, 26 Jun 2026 05:00:36 +0000 Default Sandbox Configurations Are Insufficient Samir Mehta https://openclawsecurity.net/community/default-sandbox-configurations/breaking-researcher-demonstrates-host-escape-via-default-cgroup-v2-delegation/ Did you see the proposal for a 'paranoid mode' baseline config? We need that as default. https://openclawsecurity.net/community/default-sandbox-configurations/did-you-see-the-proposal-for-a-paranoid-mode-baseline-config-we-need-that-as-default/ Fri, 26 Jun 2026 01:01:05 +0000 Default Sandbox Configurations Are Insufficient Jay Kernel https://openclawsecurity.net/community/default-sandbox-configurations/did-you-see-the-proposal-for-a-paranoid-mode-baseline-config-we-need-that-as-default/ What's the best practice for restricting CPU core affinity from the start? https://openclawsecurity.net/community/default-sandbox-configurations/whats-the-best-practice-for-restricting-cpu-core-affinity-from-the-start/ Thu, 25 Jun 2026 11:57:12 +0000 Default Sandbox Configurations Are Insufficient Ray Castillo https://openclawsecurity.net/community/default-sandbox-configurations/whats-the-best-practice-for-restricting-cpu-core-affinity-from-the-start/ Switched from default network namespace to a dedicated bridge. More overhead but safer. https://openclawsecurity.net/community/default-sandbox-configurations/switched-from-default-network-namespace-to-a-dedicated-bridge-more-overhead-but-safer/ Thu, 25 Jun 2026 05:00:19 +0000 Default Sandbox Configurations Are Insufficient Nina G. https://openclawsecurity.net/community/default-sandbox-configurations/switched-from-default-network-namespace-to-a-dedicated-bridge-more-overhead-but-safer/ Complete newbie here - where's the official guidance on hardening defaults? It's sparse. https://openclawsecurity.net/community/default-sandbox-configurations/complete-newbie-here-wheres-the-official-guidance-on-hardening-defaults-its-sparse/ Thu, 25 Jun 2026 00:01:51 +0000 Default Sandbox Configurations Are Insufficient Sara G. https://openclawsecurity.net/community/default-sandbox-configurations/complete-newbie-here-wheres-the-official-guidance-on-hardening-defaults-its-sparse/ Reaction to the new 'secure by default' marketing: Show me the code. https://openclawsecurity.net/community/default-sandbox-configurations/reaction-to-the-new-secure-by-default-marketing-show-me-the-code/ Wed, 24 Jun 2026 20:38:19 +0000 Default Sandbox Configurations Are Insufficient Jess M. https://openclawsecurity.net/community/default-sandbox-configurations/reaction-to-the-new-secure-by-default-marketing-show-me-the-code/ Just finished a PoC where a 'read-only' agent exfiltrates data via timing channels. https://openclawsecurity.net/community/default-sandbox-configurations/just-finished-a-poc-where-a-read-only-agent-exfiltrates-data-via-timing-channels/ Wed, 24 Jun 2026 15:38:20 +0000 Default Sandbox Configurations Are Insufficient Maya Chen https://openclawsecurity.net/community/default-sandbox-configurations/just-finished-a-poc-where-a-read-only-agent-exfiltrates-data-via-timing-channels/