Opening someone else's project should not run its code on your Mac without asking

AI coding tools have a new kind of risk. You download a project from GitHub, open it in your editor, ask the AI to look around, and something on your computer runs that you never asked for. Not because the AI was tricked into doing something clever, but because the tool trusted a file inside the project.

We audited K2Coder for exactly this and built fixes for the ways we found. This post explains what changed. The fixes are built and tested, and they ship in the next K2Coder update for Mac. Version 1.1.0, the build on the download page today, does not have them yet.

What is the problem with a project's own commands?

Every K2Coder project has a small settings file, .k2/project.json. It says how to start the project (for a website, the command that serves it) and how to check it (for a web app, the build command). K2Coder reads that file so that ▶ Run and Check do the right thing without you typing anything.

That convenience is also the problem. Those commands run on your Mac, as you, outside any sandbox. For a project K2Coder created, that is fine: K2Coder wrote the commands. For a folder you cloned from the internet, the file says whatever its author wanted. Before this change, simply starting a chat in a cloned website folder started its run command, with no question asked.

What changes in the next update?

K2Coder asks before running a project's declared command outside its sandbox. The first time you press ▶ Run or Check in a folder, K2Coder shows you the command the project declares and asks. Until you say yes, a chat there does not start the project's server. Say yes, and it remembers that exact command for that folder. Change a single character of that command, and it asks again. A change to a script the command calls, such as one in package.json, does not trigger a new question. Projects K2Coder creates after the update are approved when they are made. Projects made with an earlier version ask once, the first time you run or check them.

The approvals are stored in K2Coder's own data folder on your Mac, never inside the project. A cloned repository cannot approve its own commands, and below Full auto neither can K2Coder's agent.

In Edit files mode, K2Coder's agent can change your code, and the only commands it can run are the project's own checks, such as its tests, inside a sandbox with no network. It used to be able to write .k2/project.json, which meant it could leave a command there for K2Coder to run the next time you pressed ▶ Run. In the next update, below Full auto, those settings files are read-only to K2Coder's own agent, however the path is spelled and even through a link. The agent can still edit your code, including the package.json scripts that ▶ Run and Check call for web apps and API servers, so look at what it changed before you run it.

The agent's browser stays away from K2Coder itself. K2Coder gives the AI a real browser so it can look at the site it is building. That browser could previously open K2Coder's own window address, which would have let the agent click its own Terminal or switch itself into Full auto. In the next update it refuses those addresses, and it blocks a page that tries to reach them by a link, a redirect or a script.

K2Coder's web-reading tool cannot be pointed at your home network. When K2Coder's own agent reads documentation from the web, it may only read public sites. One way of writing a private address (an IPv6 form of a local address) slipped past the check in the new web-reading tool before it shipped. It no longer does.

How did we check it?

Every change has tests, and the important ones run the real thing: a real server, a real headless browser, a scripted AI model that tries to write the settings file. Then we broke each fix on purpose, one at a time, and confirmed a test failed every time. When one did not, we rewrote that test until it did.

What has not changed?

Some limits are worth stating plainly, because a security post that only lists wins is not much use.

• Full auto is still full auto. In that mode the agent can run any command, by design. Use Edit files for projects you did not write. Until the update, also read a website folder's .k2/project.json before starting a chat there, because version 1.1.0 starts its run command in any mode.
• The Windows version, still being built, has no sandbox yet for the agent's checks, which on the Mac run in one from the next update. So on Windows, in Edit files mode, the agent runs no commands at all, not even the project's checks.
• Deploying runs the project's install and build steps outside the sandbox. When you deploy from the new Ship tab in the next update, K2Coder first installs the project's packages if needed and runs its build on your Mac, without a separate question.

When do you get it?

The fixes ship with the next K2Coder update for Mac, which will be on the download page when it is out. Until then, open projects from people you do not know in Edit files mode, and before you start a chat in a folder you did not create, open its .k2/project.json and read the run and check commands: in version 1.1.0, starting a chat in a website folder runs its run command without asking, and ▶ Run and Check run those commands as written. Read the file again before you press ▶ Run or Check, because in 1.1.0 the agent can change it even in Edit files mode.

K2Coder is free to download at quantumaccordbg.com/k2coder.