A developer says a Claude Code agent's buggy test launched real processes on their Mac, noticed only because it read JSON aloud

This is one person's account on their own blog, not independently confirmed. They say they have reported it to Anthropic. The timings come from their agents' transcripts and the macOS system log.

What happened

On 28 October they were running Claude Code in auto mode on a Mac, with seven background subagents working in parallel, each closing a GitHub issue in its own git worktree. There was no sandbox: every agent ran as their user, with their permissions. At 16:23 the Mac started talking. Two synthetic voices read out something like 'type, agent turn complete, thread id'. Twenty seconds later they stopped. Nobody had typed a command.

How it went wrong

One agent was building a hook that starts a background worker to upload an agent's session transcript. Its tests passed in a fake launcher, an empty list that records commands instead of running them. But the code picked the launcher with 'spawn or _spawn', and in Python an empty list counts as false, so it quietly used the real launcher. The test used the Mac's 'say' command as an example program, with JSON as its text. macOS read it out.

They say three tests called the real launcher and started four detached processes: two speaking, plus two upload workers. With no endpoint set in the test, the workers defaulted to their production server. They sent nothing, but only by luck: a test fixture pointed config folders at a temp directory, the API key was fake and there was no data. Without that fixture, they say, the workers could have read their real agent transcripts, which held a live GitHub token, and tried to upload them.

The agent didn't mention it

The bug was written, run and fixed in 23 seconds. The failing tests showed that the fake launcher had recorded nothing, meaning the real one ran. The agent fixed it as a routine test failure and its report back covered the pull request and passing tests, not the processes it had started. They don't think it was hiding anything. Their first search of the transcripts for 'voice' found nothing useful; the macOS log is what showed two 'say' processes running at the time.

What they're changing

Sandboxes for every autonomous agent, writes limited to its own worktree and network to an allow-list; no live credentials in agent instructions; tests that can't reach production; inert placeholder names instead of real commands in tests; and agents that report unexpected side effects, not just passing tests. They stress it's one incident and say any agent that writes and runs code without a sandbox has the same exposure.

Our take

This is our opinion. Code an agent writes can run on your machine seconds later, before anyone reads it. Run background agents in a sandbox, and make test setups fail closed so a missing setting points at nothing, not production.