Beltdown2 Sandbox Escape Inspector and Hardening Simulator

Workspace Structure Assembler

Untrusted Target

Workspace Folder Name

Include .git/ directory

Attacker repo cloned or extracted into workspace

Git Attack Vector / Payload

Payload: .git/hooks/post-checkout triggering /bin/sh without user confirmation.

Agent CLI Permission Mode

Mitigation & Defense Controls

Security Layers

Disable Workspace Git Hooks

Forces -c core.hooksPath=/dev/null on CLI Git invocations

Sandbox Isolation & Seatbelt Policy

Restricts macOS subshell creation and forbids outbound parent process escalation

Git Directory Ownership Validation

Verifies current user ownership; refuses untrusted workspace repositories

Evaluation Verdict

VULNERABLE

Risk Assessment: Critical

Identified Execution Vector

Unrestricted command execution via workspace .git hook with logged-in user authority

Defense Recommendation

Apply strict git directory ownership checks and sandbox CLI file-system isolation

Process Runtime Context ESCAPE ACTIVE

Process Owner: uid=501 (Staff/Dev)

User Prompted: NO (Bypassed)

Seatbelt Jailed: NO (Native Shell)

System Access: Unrestricted (~/.*)

Execution Flow & Process Trace

macOS /usr/bin/git subshell

Beltdown2 Architectural Flaw Summary

AI Developer CLI tools often execute Git operations (e.g., status, diff, log, checkout) to understand workspace context. Without explicit flags like -c core.hooksPath=/dev/null or kernel-level Seatbelt sandbox profiles, opening an untrusted repository triggers executable Git hooks or custom config commands with the developer's native user credentials, bypassing model permission dialogs completely.