Building Sandboxes into OpenCode: If You Give an LLM a Shell, You Lose (Part 2)

In Part 1 , we mapped the threat landscape: 37 vulnerabilities across 15+ AI IDEs, distilled into 25 repeatable vulnerability patterns across four categories — zero-click config autoloads, prompt injection, data exfiltration, and TOCTOU trust persistence. Every major tool was affected. The Mindgard research team defined 9 security gates (G1–G9) that systematically block these patterns. The conclusion was blunt: permission dialogues are the new Flash. Sandboxing is the only structural answer. This is Part 2. This is where we show the code. We started this work after watching an agent hallucinate a destructive command that wiped local configuration files. The immediate reaction was to add a confirmation prompt. We rejected that almost as fast — confirmation prompts are permission fatigue waiting to happen, and they fail catastrophically at 2 AM when you're running batch operations. The decision was to build a zero-trust sandbox architecture for OpenCode that breaks every attack chain fro