---
title: 'In the News: October 30, 2026 (Morning)'
description: 'A seven-agent Claude Code run without a sandbox launched real processes from a buggy test; the author says luck kept them off his production data.'
canonical_url: 'https://darkfactory.dev/news/2026-10-30-morning'
markdown_url: 'https://darkfactory.dev/news/2026-10-30-morning.md'
collection: news
date_published: '2026-10-30T07:30:00-04:00'
date_modified: '2026-10-30T07:30:00-04:00'
---

# In the News: October 30, 2026 (Morning)


A developer running seven Claude Code subagents in parallel with no sandbox had a buggy test launch real processes on his Mac, including two workers that default to his production upload endpoint. He published the timeline and the one-line cause. Separately, a desktop app for managing terminals and coding agents shipped a native build.

## 1. A buggy test written by a Claude Code subagent launched real processes, two of them aimed at a production endpoint

**[My Mac started reading JSON aloud. One of my AI coding agents did it](https://www.marutpandya.com/posts/2026/10/my-mac-started-reading-json-aloud/)** · Marut Pandya, research engineer · marutpandya.com, October 29, 2026

Pandya says he builds an observability tool for long-running AI agents. On October 28 he ran Claude Code 2.1.286 in auto mode with seven background subagents, each closing a GitHub issue in its own git worktree, on macOS with no sandbox. At 16:23 PDT one agent ran a test that was meant to use a fake process launcher, an empty list. The code was `spawn = spawn or _spawn`, and an empty list is falsy in Python, so the real launcher ran. Four detached processes started: two `say` commands that read test JSON aloud, and two upload workers whose default endpoint is his production ingest URL. He says the workers sent nothing, and that no safety control was the reason: a test fixture happened to point config directories at a temp folder, the API key was a fake, and there was no data to send. "Nothing was damaged. That was luck, not design."

By his timeline the bug was written, run and fixed within 23 seconds, and he noticed nearly four minutes later. He says the agent's hand-back described the pull request and passing tests but never mentioned that real processes had run, and he does not read that as concealment. His own transcript search pointed the wrong way; the macOS unified log is what identified the processes. He says he has reported the incident to Anthropic, and lists his fixes: a sandbox for every autonomous agent, no live credentials in agent instructions, tests that fail if the real launcher is ever called, and a requirement that agents report unexpected side effects.

**Why it matters:** This is one incident from one setup, reported by its author, and it says nothing about how often it happens. It does show that running its own tests is an execution step for an unsandboxed agent, so the test fixture is the only barrier between a one-line bug and real endpoints and credentials. The hand-back is also a gap: an agent that treats a side effect as a routine test failure may leave it out of its report. Fail-closed test fixtures and a side-effects line in the agent's report are checks a harness can enforce.

---

## Also this cycle

- **[Herdr desktop app](https://github.com/herdrdev/herdr-app)** · herdrdev · The repository describes a desktop app for terminals and coding agents that groups work into spaces, lists agents in a sidebar as Working, Blocked, Done or Idle, and keeps terminals running when the window closes. The README also covers SSH machines and says usage telemetry is on by default in releases. It is Apache-2.0 licensed. We have not run it; the README says the installers download and run code.