Two Claude Code sandbox bypasses in five months, both fixed silently. What does the shared responsibility model look like for AI agents?

Researcher Aonan Guan disclosed a second Claude Code network sandbox bypass via HackerOne this month. The mechanism: SOCKS5 hostname null-byte injection. The JavaScript policy layer reads the full hostname, libc stops at the null byte, so traffic the policy approves resolves to a different host. Affected versions 2.0.24 through 2.1.89, roughly 130 releases over 5.5 months. Both fixes were silent, no security advisory either time. Cloud infrastructure spent a decade building a shared responsibility model: the vendor secures the platform, the customer owns what runs on it. Runtime visibility, egress controls, identity at the action layer, data allowlists. That split is well understood. AI agents don't have one yet. Anthropic secures the sandbox; But runtime visibility into what the agent actually did, what tools it called, what data moved, sits on the customer side of the line. Two silent fixes in five months should prompt you to ask what you actually own.