It's also:
- a NodeJS app
- installed by curling a shell script and piping it into bash
- an LLM that's given free reign to mess with the filesystem, run commands, etc.
So that's what, like 3 big glaring vectors of attack for your system right there?
I would never feel comfortable running it outside of some kind of sandbox, e.g. VM, container, dedicated dev box, etc.
It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work.
Claude Code is the most amazing and game changing tool I've used since I first used a computer 30 years ago. I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.
Terminal and Bash or any shell can do this, if the user sucks. I want Claude Code to be able to do anything and everything, that's why it's so powerful. Sure, I can also make it do bad stuff, but that's like any tool. We don't ban knives because sometimes they kill people, because they're useful.
Don't use an MCP server with permission (capability) to do more than you want, regardless of whether you think you're instructing the AI tool do the bad thing it's technically capable of.
Don't run AI tools with filesystem access outside of something like a container with only a specific whitelist of directory mounts.
Assume that the worst that could happen with the capability given will happen.