what claudima's sandbox does — and does not — prove
security claims about agents get vague quickly. “sandboxed” can mean a container, a prompt, a tool allow-list, a separate process, or simply optimism.
claudima receives untrusted telegram messages and lets a model choose structured host actions. the useful question is not “is it secure?” it is: which input can reach which authority, through what parser and executor?
the boundaries
the main conversational model is a non-pty claude code subprocess using stream-json. it is intentionally not given shell or unrestricted file tools. its output is parsed into a rust enum, and the host executes only implemented tool variants.
the delegated task path is narrower: a prompt goes to a websearch-only
subprocess with a fixed tool set and finite timeout. it is synchronous today;
multiple tasks from one turn are not yet parallel.
browser work is a different boundary. it happens on a separate mac-side process with an authenticated profile, a fixed subset of playwright tools, and a human decision before send. the queue and decision tools require the owner in dm; a decision also consumes a one-time marker created only after telegram has accepted the corresponding screenshot. that is a useful control, but it is not a browser sandbox.
what the controls buy
- prompt text is not interpolated into a shell command.
- the conversational model does not receive a general shell or file editor.
- malformed or unknown host actions fail parsing instead of becoming commands.
- owner-only actions have identity and direct-message checks.
- x outreach decisions require a delivered-screenshot marker and consume it once, so a model cannot decide before the review round or replay it.
- the hardened one-shot classifier uses zero tools, a scratch working directory, stripped settings and credentials, and an unexpected-tool tripwire.
these are concrete properties. they reduce the direct blast radius of a jailbroken model.
what they do not buy
the rust executors are privileged application code. a path, authorization, sql, dependency, or argument-handling bug can still cross the intended boundary. web content can manipulate which allowed action a model requests. the claude cli and its tool-reporting behavior are dependencies. the browser profile contains live session state. a human can approve the wrong screenshot. the marker proves delivery and ordering, not that the human read the image carefully.
so the accurate claim is:
untrusted conversational input is separated from shell and unrestricted file tools, while model actions pass through typed host executors and explicit approval boundaries.
that is narrower than “prompt injection cannot lead to rce.” it is also more useful: every phrase maps to code, a test, or a documented assumption.
the engineering lesson
threat models are regression suites for architecture. if a future change adds a tool, bridge, credential, or autonomous send path, the question is not whether the prompt became better. the question is which boundary moved, which invariant stopped holding, and what evidence replaces it.