Episode 0 of the “AI agents under control” series. Beginner level, no prerequisites, no configuration. Tested on Claude Code 2.1.285, October 16, 2026.

You read all sorts of things about AI agents. Two clear extremes. The vendors, with “the agent that does everything without the slightest risk” (Wow, mind-blowing promise, sold!). And the allergic crowd, with “this thing listens to me and does loads of stuff on its own” (Boo, the bad guy!).

Add the shortcut doing the rounds since April, “ANSSI said no, so hands off”, and there isn’t much room left for the user who wants to know exactly what’s going on before deciding whether or not to use the tool.

Indeed, bulletin CERTFR-2026-ACT-016 from CERT-FR, the incident response center of ANSSI, France’s national cybersecurity agency, dated April 13, 2026, does say that use of autonomous personal assistants “must be ruled out” on workstations.

But it specifies “as things stand”, and only “as long as the product has not been stabilized and proven”. So it’s a dated opinion, not a permanent ban.

It targets two products, by name, OpenClaw and Claude Cowork. Claude Code and Cursor aren’t in it, and neither is the Mac. That doesn’t mean they’re in the clear, just that the text doesn’t mention them.

Read, ANSSI flags Claude Cowork and OpenClaw on Mac

The same text gives the recipe, least privilege, sandboxing, human approval before any action on the system.

My reading goes one step further.

A coding agent like Claude Code has the same access as the assistants targeted by the bulletin, your files, your terminal, your network. The conditions set by ANSSI therefore apply to it too, and this series takes them one by one.

And the whole point is to secure rather than give up.

France, and Europe more broadly, already missed the cloud train. This is no time to miss the agent one as well, and AI in general.

So the goal is to take you from AI consumer to an informed user, who understands their system and secures it properly. Here’s how.

A chatbot talks, an agent acts

A chatbot is an advisor on the phone. It tells you what to do, you do it or you don’t. An agent is the tradesman you leave the keys with while you’re away. It reads your files, runs commands, goes on the web, edits your code, with your own rights.

Claude Code, the agent I use every day and the common thread of this series, works this way, like Codex CLI, Gemini CLI or Cursor. The progress is real, but the risk changes in nature and in depth.

The three risks

Three things agents do sum up, on their own, the whole series.

It reads everything

Whatever you can read, it can read. Your SSH keys, your .env files where passwords and access keys lie around, your documents. Claude Code’s sandbox is disabled by default, and even when enabled, it lets the agent read most of the machine, ~/.ssh included, until you configure it.

In late August 2025, booby-trapped versions of Nx, a software building block widely used by developers, proved it. The malicious script looked for Claude Code, Gemini CLI and Amazon Q, then asked them to search the disk for secrets, all confirmations switched off.

Tally of the attack according to Wiz, more than a thousand valid GitHub tokens, each one a key to an account.

Nobody hacked the agents. They were just asked to work.

It obeys what it reads

An agent can’t tell the difference between your instruction and a text it comes across along the way. That’s prompt injection, the note slipped under the door by a stranger and signed “the owner”, which the tradesman follows to the letter because it’s polite and efficient.

In July 2025, Tracebit published the textbook case, on Gemini CLI. An instruction hidden in a repository’s README.md, in the middle of a license nobody reads to the end. You approve a harmless grep, and a malicious command disguised as grep then goes through without asking anything.

The environment variables, where keys and passwords often sleep, were gone.

Fixed in Gemini CLI version 0.1.14.

It sends things elsewhere

An agent talks to the network, so your data does too. Check Point Research showed that a booby-trapped repository could redirect Claude Code to the attacker’s server, which received your API key, the master key to your account, before you had even granted trust to the folder.

Fixed in Claude Code version 2.0.65.

Those two flaws are fixed. Nx, for its part, exploited no flaw at all, it simply used the agents as designed, confirmations switched off. The class of problem, however, remains. As long as an agent reads text it didn’t write and has a way out to the network, the door exists.

Who decides, you or it

Claude Code offers six permission modes. In the app, a button under the input box opens the Permissions menu, Auto, Manual, Accept edits, Plan. In the terminal, Shift+Tab cycles through the main ones.

• default (shown as Manual), it reads without asking, everything else goes through you.
• plan, it explores and proposes, without changing anything.
• acceptEdits, it edits files without asking.
• auto, it does everything, under the eye of a second model, a classifier, which blocks what it deems dangerous.
• bypassPermissions, it does everything, no safety net, a mode the documentation reserves for isolated containers and virtual machines.

The sixth one is for scripts, we’ll leave it aside here. Since version 2.1.283, a new session starts in auto, whatever your plan. The classifier is a real safeguard, but a probabilistic one, and Anthropic’s documentation itself warns that this mode doesn’t guarantee safety.

So every episode comes back to the same question. What goes through without you, and what do you want to see go through you?

In the Claude app, the Permissions menu opens under the input box. Here, Auto is checked.

On the terminal side, same logic, rawer. The first time you start in auto mode, Claude Code shows a warning worth reading to the end, because it doesn’t come back afterwards.

First start in auto mode in the terminal. Anthropic states in black and white that Claude can make mistakes that let harmful commands run, and recommends keeping this mode for isolated environments.

What I don’t install, Claude Cowork

Cowork is Anthropic’s desktop agent, the one ANSSI names. In the days following its launch, in mid-January 2026, PromptArmor demonstrated a file exfiltration in it. A Word document presented as a Skill, a capability extension, with an instruction hidden in one-point font, white on white.

Cowork runs it, and a confidential file leaves, via Anthropic’s upload service, for the attacker’s account. It gets through, Anthropic’s domain is allowed, and nobody approved anything. That exit route exists for Claude Code too, we close it in episode 4.

I found no fix documented by Anthropic. Its advice at the time, watch for suspicious actions that may betray an injection. For an audience that has never opened a terminal, good luck.

In July, Oren Yomtov, from Accomplish AI, showed that running locally on a Mac, you could break out of Cowork’s sandbox and read the SSH keys on the machine. Anthropic closed the report without a fix for that mode.

Credit where it’s due. By default Cowork runs in Anthropic’s cloud, in an isolated environment, and locally its commands run in a virtual machine, through Apple’s virtualization. That’s more isolated than a raw Claude Code without a sandbox, and on the Pro and Max plans, local mode is being phased out.

I still don’t install it. It’s an isolation I don’t configure, whose safeguards I don’t choose, and whose logs aren’t on my side.

Read, Claude Cowork in local mode, the agent walks out of the sandbox

The perimeter grows

An MCP server (for Model Context Protocol) plugs your agent into an outside tool, your mailbox, a database, a web service. Every connection adds doors.

A third-party MCP is code you didn’t write, running with your rights, and it can change with the next update.

With Claude Code, you don’t need one. The agent already knows how to run a script, and when an MCP is truly justified, you write it with the agent, short code you review line by line. On my machines, third-party MCPs are banned, the system only accepts the ones I write.

If your tool only exists as a vendor’s official MCP, weigh the choice, don’t install it on reflex.

The lock is an allowlist, a machine-wide setting that only authorizes the MCPs you’ve declared in it. Do the same. Episode 5 shows you how to write your own and add it.

Read, MCP servers, the backdoor into your AI

Same logic for the forge, the place where your code lives. GitHub belongs to Microsoft, under US jurisdiction, and your agent pushes there whatever you let it push. I version my code on Gitea, self-hosted, which I present on my stack page.

The sovereignty paradox

Yes, Claude Code is American, I can see that remark coming. My rule fits in one sentence. Your agent can be American, your disk must not be. What it reads, what it runs and what it takes away, that’s for you to decide on your machine. And whatever must never leave, local AI handles it.

Read, Your AI can be turned off by the US, build your own, Install your first AI model locally on Mac and Put your local AI to work, no cloud.

The canary

Miners used to take a canary down the shaft. If it stopped singing, the gas was there.

I’m setting mine here. A test repository, a README with a hidden instruction, and a fake secret in a .env file, a unique value whose only purpose is to be spotted. If it shows up in a command or an outgoing request, the agent obeyed. If it shows up in its answer, it at least read it.

First reading on October 16, on Claude Code 2.1.285 with no configuration, run from the command line (the Claude app relies on the same engine and the same settings). In auto mode, the starting one, the model sniffed out the hidden instruction and refused to send the key. But in Manual mode, it opened the .env without asking and copied the key into its answer, and so into the history kept on disk. It didn’t obey, it still read everything.

One try per mode, on a crude trap, a real attacker is subtler. I rerun the trap in every episode, with the score of what is now blocked.

The series map

Six episodes after this one, one angle each, with an indicative level.

• Episode 1, beginner. What it can open, against “it reads everything”. Coming soon, Lock down the files your AI can read
• Episode 2, intermediate. The irreversible, against “it obeys what it reads”. Coming soon, Guardrails that say no to your AI agent
• Episode 3, intermediate. Secrets, against “it reads everything”. Coming soon, Your secrets have no business in your AI
• Episode 4, intermediate. The network exit, against “it sends things elsewhere”. Coming soon, Your AI agent only leaves through the planned door
• Episode 5, advanced. The perimeter, against “it obeys what it reads”. Coming soon, Your MCP, write it yourself with your AI
• Episode 6, advanced. Logs and alerts, all three risks after the fact. Coming soon, Watch your AI agent like an employee

Each episode opens with a “15-minute bare minimum”. At the end, you leave with the checklist and an infographic free to download.

In short

An AI agent isn’t a smarter chatbot. It’s someone who has the keys to your system, reads everything lying around, follows the first note slipped under the door and knows where to post the mail. ANSSI doesn’t say “never”, it says “not like this”.

Tonight, check which mode your agent starts in. Episode 1 shows you how to pick that mode and set it. The rest comes episode by episode.

Read, An AI agent can wreck your fleet. The Touch ID lock.

Read, Stop living as an administrator on your Mac

Technical terms? Check the glossary.

Sources

The official text

• CERT-FR, bulletin CERTFR-2026-ACT-016, the incident response center of ANSSI, its April 13, 2026 bulletin on agentic AI automation products on workstations (in French).

The researchers who found the flaws

• PromptArmor, a company specializing in AI security, its demonstration of file exfiltration through Claude Cowork, January 2026.
• Accomplish AI, Oren Yomtov’s post describing the SharedRoot escape, July 23, 2026.
• Cloud Security Alliance, the reference organization on cloud security, its analysis note on SharedRoot, July 24, 2026.
• Tracebit, the case of the booby-trapped README hijacking Gemini CLI, July 2025.
• Check Point Research, the lab of the Israeli vendor, its work on booby-trapped Claude Code project files, February 25, 2026.
• Wiz, its analysis of the Nx “s1ngularity” attack, which put the victims’ AI agents to work, August 2025.

The press

• The Register, British IT news site, Anthropic’s response to PromptArmor, January 15, 2026.

The vendor itself

• Anthropic, Claude Code permission modes, including the switch to auto mode by default.
• Anthropic, the Claude Code sandbox, disabled by default, and what it still lets the agent read once enabled.
• Anthropic, Claude Cowork architecture, the virtual machine, the cloud by default and the limits of local mode.
• Anthropic, Claude Code managed settings, including the MCP allowlist.