OpenClaude Sandbox Bypass via Model-Controlled dangerouslyDisableSandbox Parameter

LLM-settable flag in the BashTool schema flips sandbox enforcement off when combined with the permissive allowUnsandboxedCommands: true default, yielding host-level RCE from prompt injection

OpenClaude, the open-source coding-agent CLI from Gitlawb, ships versions prior to 0.5.1 with a critical sandbox-escape flaw. Its BashTool exposes a dangerouslyDisableSandbox parameter directly inside the schema the LLM itself populates — meaning the model, not just the operator, can turn sandboxing off. Combined with a default allowUnsandboxedCommands: true policy, a single prompt-injected tool call lets an attacker achieve full host-level command execution: reading credentials, writing arbitrary files, opening reverse shells, and pivoting into connected infrastructure. No operator error is required — only default configuration. Fixed in OpenClaude 0.5.1.