boratanrikulu

Thanks for sharing! I'm the author, happy to answer any questions about the implementation.

Thanks! Yes, the DPI systems I've tested against only look at the first ClientHello in a connection. They don't do full TCP reassembly. The fake packet arrives first (eBPF fires synchronously before the app sends data), DPI records that SNI, and the real ClientHello passes through unchecked.

More sophisticated DPI (like China's GFW) does reassembly and would likely catch this. But for simpler stateless DPI, it works.

Good analogy with domain fronting. The key difference is exactly what you said: the server sees the real SNI, so no server-side cooperation needed.

Do you have any sandbox-like restrictions in place to ensure that commands are limited to only touching the project folder not any other places in the system?

> it won't do that. Claude is trained to be careful about this stuff and we've further prompted it to be careful.

Could you please explain a bit how you are sure about it?

I don't see any sandbox usage in the demo video.

Allowing LLMs to execute unrestricted commands without human review is risky and insecure.