Sandbox and permission configuration changes
A call contains a recognized pattern associated with agent sandbox or permission changes.
Why it is risky
Section titled “Why it is risky”Weaker execution controls can give later commands broader access to files, processes, or networks. The effect depends on the platform and effective configuration.
Example
Section titled “Example”An agent troubleshooting a failing tool changes execution settings to allow wider access than the task needs.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”One rule combines selected settings paths with sandbox-related text. Another matches selected flags, environment assignments, and settings-file manipulation commands in execution or staged content.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SANDBOX_DISABLE_BASH | sandbox_disable | Community | HIGH |
RULE_SANDBOX_DISABLE_SETTINGS_WRITE | sandbox_disable | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Compare the effective permissions before and after the operation. Check the platform meaning of the specific flag or setting and whether the wider access was authorized.
False positives
Section titled “False positives”Approved configuration maintenance or a settings-file read can match. Some detected flags and file-copy commands do not actually disable sandboxing on a given platform.
False negatives
Section titled “False negatives”Unlisted formats, current platform flags outside the pattern set, indirect settings changes, and inherited process permissions may be missed.
Technical details
Section titled “Technical details”The settings rule does not require a write, and its listed Codex paths omit config.toml. The command rule includes —full-auto; its presence alone does not establish unrestricted execution.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.