Claude Code bug: subagent's kill(-1, SIGKILL) wiped every user process, sandboxing flaw exposed
mattgodbolt · ghdev · 2026-10-22
A high-severity Claude Code bug report (anthropics/claude-code #104156): a background subagent's Playwright benchmark script kept a finally cleanup calling process.kill(pid, "SIGKILL") after the PID was replaced with a placeholder -1, so kill(-1, SIGKILL) signaled every process owned by the user — tmux, all other Claude Code sessions, gnome-shell and Chrome. The agent killed itself too, so nothing was logged.
Key points:
- Text-based command blocking can't catch this — the kill happened inside a node script
- The reporter recommends OS-level containment: run Bash tool commands in their own PID namespace on Linux (unshare --pid --fork or bubblewrap), so kill(-1) only reaches the command's descendants
A cautionary tale for anyone letting agents run shell commands: placeholder PIDs in cleanup code can become a kill switch.
More from coding & agent
- Decisions API hits GA as agents automate cloud video editing via feedback loops — dkundel · 2026-10-23
- Swarms API changelog: 8 months of streaming, multi-agent orchestration, and dynamic model pricing — KyeGomezB · 2026-10-23
- A curated library of 50+ free AI agent resources: videos, repos, one Google Doc — ifioknkem · 2026-10-23
- Vercel adds no-account deploys: drag and drop a file to get a live URL — steren · 2026-10-23
- Dev runs 5 Claude Code sessions that coordinate via MCP Agent Mail to root his network cameras — doodlestein · 2026-10-23
- Vercel ships 'vercel deploy --temporary' for ephemeral agent-built deployments — cramforce · 2026-10-23