Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.

I recently wrote I'm inspecting everything I thought I knew about software and considering their ongoing relevance in this new era of coding agents. Here's one…

I recently wrote (https://justin.searls.co/posts/full-breadth-developers/#good-game-programmers) I'm inspecting everything I thought I knew about software and considering their ongoing relevance in this new era of coding agents. Here's one area where I've completely changed my mind. I've long been an advocate for promoting individual autonomy on software teams. At Test Double (https://testdouble.com), we founded the company on the belief that greatness depended on trusting the people closest to the work to decide how best to do the work. We'd seen what happens when the managerial class has the hubris to assume they know better than someone who has all the facts on the ground. This led to me very often showing up at clients and pushing back on practices like: • Top-down mandates governing process, documentation, and metrics • Onerous git hooks (https://git-scm.com/docs/githooks) that prevented people from committing code until they'd jumped through a preordained set of hoops (e.g. blocking commits if code coverage dropped, if the build slowed down, etc.) • Mandatory code review and approval as a substitute for genuine collaboration and collective ownership More broadly, if technical leaders created rules without consideration for reasonable exceptions and without regard for whether it demoralized their best staff… they were going to hear from me about it. I lost track of how many times I've said something like, " if you design your organization to minimize the damage caused by your least competent people, don't be surprised if you minimize the output of your most competent people." ## Well, never mind all that (#well-never-mind-all-that) Lately, I find myself mandating a lot of quality metrics, encoding them into git hooks, and insisting on reviewing and approving every line of code in my system. What changed? AI coding agents are the ones writing the code now, and the long-term viability of a codebase absolutely depends on establishing and enforcing the right guardrails within which those agents should operate. As a result, my latest project is full of: • Authoritarian documentation dictating what I want from each coder with granular precision (in https://docs.anthropic.com/en/docs/claude-code/memory) • Patronizing step-by-step instructions telling coders how to accomplish basic tasks, repeated each and every time I ask them to carry out the task (as custom slash commands (https://docs.anthropic.com/en/docs/claude-code/slash-commands)) • Ruthlessly rigid scripts that can block the coder's progress and commits (whether as git hooks and Claude hooks (https://docs.anthropic.com/en/docs/claude-code/hooks)) Everything I believe about autonomy still holds for human people, mind you. Undermining people's agency is indeed counterproductive if your goal is to encourage a sense of ownership, leverage self-reliance to foster critical thinking, and grow through failure. But coding agents are (currently) inherently ephemeral, trained generically, and impervious to learning from their mistakes. They need all these guardrails. All I would ask is this: if you, like me, are constructing a bureaucratic hellscape around your workspace so as to wrangle Claude Code or some other agent, don't forget that your human colleagues require autonomy and self-determination to thrive and succeed. Lay down whatever gauntlet you need to for your agent, but give the humans a hall pass.