AI coding tools have a new kind of risk. You download a project from GitHub, open it in your editor, ask the AI to look around, and something on your computer runs that you never asked for. Not because the AI was tricked into doing something clever, but because the tool trusted a file inside the project.
We audited K2Coder for exactly this, found the ways it could happen, and closed them. This post explains what changed. The fixes are built and tested, and they ship in the next K2Coder update for Mac. Version 1.1.0, the build on the download page today, does not have them yet.
The problem: a project can describe its own commands
Every K2Coder project has a small settings file, .k2/project.json. It says how to start the project (for a website, the command that serves it) and how to check it (for a web app, the build command). K2Coder reads that file so that ▶ Run and Check do the right thing without you typing anything.
That convenience is also the problem. Those commands run on your Mac, as you, outside any sandbox. For a project K2Coder created, that is fine: K2Coder wrote the commands. For a folder you cloned from the internet, the file says whatever its author wanted. Before this change, simply starting a chat in a cloned website folder started its run command, with no question asked.
What changes in the next update
K2Coder asks before running a command a project declares. The first time a folder wants to start or check itself, K2Coder shows you the exact command and asks. Say yes, and it remembers that exact command for that folder. Change a single character of it, and it asks again. Projects K2Coder creates for you are approved when they are made, so nothing changes for your own work.
The approvals are stored in K2Coder's own data folder on your Mac, never inside the project. A cloned repository cannot approve its own commands, and neither can the AI working in it.
The AI cannot plant a command for you to run later. In Edit files mode the agent can change your code but not run commands. It used to be able to write .k2/project.json, which meant it could leave a command there for K2Coder to run the next time you pressed ▶ Run. Below Full auto, those settings files are now read-only to the agent, however the path is spelled and even through a link.
The agent's browser stays away from K2Coder itself. K2Coder gives the AI a real browser so it can look at the site it is building. That browser could previously open K2Coder's own window address, which would have let the agent click its own Terminal or switch itself into Full auto. It now refuses those addresses, and it blocks a page that tries to reach them by a link, a redirect or a script.
Web reading cannot be pointed at your home network. When the agent reads documentation from the web, it may only read public sites. One way of writing a private address (an IPv6 form of a local address) slipped past that check. It no longer does.
How we checked
Every change has tests, and the important ones run the real thing: a real server, a real headless browser, a scripted AI model that tries to write the settings file. Then we broke each fix on purpose, one at a time, and confirmed a test failed every time. When one did not, we rewrote that test until it did.
What has not changed
Some limits are worth stating plainly, because a security post that only lists wins is not much use.
- Full auto is still full auto. In that mode the agent can run any command, by design. Use Edit files for projects you did not write.
- The Windows version, still being built, has no sandbox yet for the agent's checks, so there Edit files mode runs no commands at all.
- Deploying runs the project's build. When you choose to deploy, K2Coder builds the project first, as you would expect.
When you get it
The fixes ship with the next K2Coder update for Mac, which will be on the download page when it is out. Until then, the advice that was always good still holds: open projects from people you do not know in Edit files mode, and read what a project wants to run before you run it.
K2Coder is free to download at quantumaccordbg.com/k2coder.