runas

What runas does on Claude C2

AI agents invoke runas to trigger actions in Claude C2. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why runas is rated High

This tool executes code/commands under a different user context, potentially with elevated privileges. The ability to run arbitrary commands as a different user (especially with escalation potential given the sibling tools like 'bypassuac' and 'defender_exclude' on the same server) represents a critical blast radius if misused by an AI agent—it could lead to unauthorized privilege escalation, lateral movement, or…

From the tool's definition "Run as different user" - executes commands with elevated or alternate user privileges, which are external operations whose effects depend on arguments (user identity, command to execute).

The rule that runs runas safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claude C2, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For runas, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "runas": {
      "limits": [
        {
          "counter": "runas_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about runas