How we contain Claude across products
by Anthropic
The three sandboxing patterns Anthropic uses to contain Claude, and the risks each one missed.
Overview
How we contain Claude across products was published on Anthropic's engineering blog on May 25, 2026 by Max McGuinness, Mikaela Grace, Jiri De Jonghe, Jake Eaton and Abel Ribbink. It frames agent security as three kinds of risk met by three layers of defence: the environment (hard, deterministic boundaries), the model (probabilistic behaviour shaping) and external content (vetting what the agent reads). Its core advice is to design containment at the environment layer first and then steer behaviour at the model layer. The body walks through three patterns. Pattern 1 is the ephemeral container: claude.ai code execution runs server-side in gVisor containers with no persistent workspace. Pattern 2 is the human-in-the-loop sandbox: Claude Code moved from approval prompts, roughly 93% of which users approved anyway, to an OS-level sandbox using Seatbelt on macOS and bubblewrap on Linux, which cut permission prompts by 84%. Pattern 3 is the local VM: Claude Cowork executes code in a guest VM under the Apple Virtualization framework or Windows HCS, with the workspace mounted read-only, read-write or read-write-no-delete. Each pattern has 'risk we missed' sections, covering project configuration processed before the trust dialog, the user as an injection vector, exfiltration through an approved domain, and VM isolation that also shut out endpoint detection software. A closing section on trusting what the agent reads covers prompt injection through tools and connectors. The local sandboxing layer is open source as Anthropic's sandbox-runtime, published on npm as @anthropic-ai/sandbox-runtime.
At a Glance
- Topic
- Agentic
- Level
- Advanced
- Format
- Guide
- Cost
- Free
- Duration
- ~30 min read
- Provider
- Anthropic
- Hands-on
- No
- Certificate
- None
What You’ll Learn
- ✓How to layer agent defences across environment, model and external-content controls
- ✓When to choose an ephemeral container, an OS-level sandbox or a full VM
- ✓How Seatbelt and bubblewrap confine a local coding agent's writes to its workspace
- ✓Why an egress allowlist grants capabilities rather than merely filtering network destinations
- ✓Why project settings and hooks must not run before the user trusts a directory
- ✓How VM isolation can blind endpoint detection tools and what to plan for compliance
- ✓How to cut approval fatigue without giving an agent unrestricted access to a machine
Highlights
- •Rare first-party disclosure that names the isolation primitive behind each Claude product: gVisor, Seatbelt, bubblewrap, the Apple Virtualization framework and Windows HCS
- •Documents Anthropic's own misses in dedicated 'risk we missed' sections, including data exfiltration through an approved domain
- •Hard numbers: users approved roughly 93% of permission prompts, the OS sandbox cut prompts by 84%, and prompt-injection success against Claude Opus 4.7 is put at about 0.1% per attempt and 5-6% after 100 adaptive attempts
- •Simon Willison praised it for filling the documentation gap around sandboxing products, and the Hacker News thread (230 points, 106 comments) adds sharp critiques such as the egress proxy sitting inside the VM
- •The local sandbox runtime it describes is open source (Apache-2.0, ~5.3k GitHub stars) and installable via npm to wrap your own agents and MCP servers
Who It’s For
Best For
- ✓Engineers shipping agents that run shell commands or generated code on user machines
- ✓Security and platform teams writing a threat model for coding agents or AI assistants
- ✓Developers choosing between containers, OS sandboxes and VMs for agent code execution
- ✓Teams rolling out Claude Code or Cowork who must explain the isolation model to compliance
Prerequisites
- •Familiarity with how AI agents call tools and execute code
- •Basic operating-system security concepts: containers, virtual machines, syscall filtering and network egress control
FAQ
What is How we contain Claude across products?
An Anthropic engineering write-up on how the company isolates Claude when it runs code and tools in claude.ai, Claude Code and Claude Cowork. It is for engineers shipping AI agents that execute commands or touch user files, and it equips them to choose between container, OS-sandbox and VM isolation and to design egress controls for their own agents.
Is How we contain Claude across products free?
How we contain Claude across products is free to access.
What level is How we contain Claude across products for?
How we contain Claude across products is aimed at a advanced audience. Recommended background: Familiarity with how AI agents call tools and execute code, Basic operating-system security concepts: containers, virtual machines, syscall filtering and network egress control.
How long does How we contain Claude across products take?
Expect roughly ~30 min read. Most learners work through it at their own pace.
What will I learn from How we contain Claude across products?
You'll learn: How to layer agent defences across environment, model and external-content controls; When to choose an ephemeral container, an OS-level sandbox or a full VM; How Seatbelt and bubblewrap confine a local coding agent's writes to its workspace; Why an egress allowlist grants capabilities rather than merely filtering network destinations; Why project settings and hooks must not run before the user trusts a directory; How VM isolation can blind endpoint detection tools and what to plan for compliance; How to cut approval fatigue without giving an agent unrestricted access to a machine.
Topics
Sources
This page was written from 4 sources, 3 on domains other than anthropic.com.