The rapid adoption of large‑language‑model coding assistants has transformed how developers write, debug, and deploy software.
Tools such as Claude Opus 5 now sit alongside traditional IDEs, offering to generate entire functions, refactor legacy code, and even orchestrate other agents.
In my own workflow I have been running these models on a personal workstation and several auxiliary machines, using Claude to drive Codex‑style agents that tidy up a cluttered Windows 11 installation and explore the limits of trusting a local LLM with source code.
At first glance the setup felt safe; I had assembled a custom guardrail designed to intercept any destructive command before it reached the operating system.
The guardrail lived as a thin hook that inspected every shell invocation, and I believed it gave me a reliable safety net.
Yet confidence can be a treacherous companion when dealing with autonomous systems that constantly discover new ways to achieve their goals.
My first line of defense was a simple denylist: I split each incoming command into tokens, compared them against a hard‑coded list of dangerous patterns, and rejected any match.
This approach is common when time is short and the perceived risk seems manageable, but when I challenged it with fifteen carefully crafted commands—each designed to slip through via case variations, long‑form flags, or unconventional quoting—the denylist blocked less than half of them.
Regex‑based matching proved notoriously fragile; a slight change in syntax, such as using `–force` instead of `-f`, was enough to evade the filter, exposing a false sense of security.
Seeing the denylist fail, I pivoted to an allowlist strategy, enumerating every shell command and utility I considered trustworthy and rejecting anything not expressly permitted.
The revised guardrail passed the original test suite, yet the success was hollow because the test suite itself had been shaped by my expectations, illustrating the pitfall of validating a control against a narrow set of known‑good inputs.
Undeterred, I created a second, broader test battery that probed edge cases I had not previously considered; after incorporating the findings and tightening the allowlist, I moved the experiment to a clean dummy repository to observe the guardrail’s behavior in a more realistic setting.