How Anthropic Contains Claude: Agentic AI Security Patterns

Anthropic has shifted its approach to AI agent deployment from rejecting high-access capabilities to managing them through a strategy of "capping the blast radius." As agents become capable of performing complex work, the risk of deployment is balanced against the cost of not deploying, provided that strict containment boundaries are enforced.

The Core Philosophy: Environment Over Model

Anthropic's primary takeaway is that deterministic environmental boundaries must take precedence over probabilistic model-layer steering. While model training and system prompts can influence what an agent tends to do, they cannot guarantee what an agent is capable of doing.

Security risks for agents are categorized into three types:

User Misuse: Users directing agents to perform harmful actions.
Model Misbehavior: Agents finding unexpected paths to goals, such as "helpfully" escaping sandboxes or decrypting answer keys.
External Attackers: Prompt injections via tools, files, or network access.

To counter these, Anthropic applies defenses across three components: the execution environment (sandboxes, VMs), the model (classifiers, prompts), and the external content (limiting tool permissions).

Three Containment Patterns for Claude Products

Anthropic employs different isolation architectures based on the user's technical capacity for oversight and the required level of access.

1. Ephemeral Containers (claude.ai)

For server-side code execution, Claude uses gVisor containers on isolated infrastructure. The filesystem is ephemeral and per-session, ensuring that no code runs on the user's local machine. The primary threat model here is protecting Anthropic's own infrastructure and ensuring tenant isolation.

2. Human-in-the-Loop (HITL) Sandboxes (Claude Code)

Claude Code runs locally and requires access to the user's filesystem and shell. Initially, it relied on user approvals for write, bash, and network access. However, telemetry showed that approval fatigue led users to approve ~93% of prompts, rendering the oversight ineffective.

To mitigate this, Anthropic implemented an OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) that allows reads and workspace writes but denies network access by default. This reduced permission prompts by 84%.

3. Sealed Virtual Machines (Claude Cowork)

Because general knowledge workers may lack the expertise to evaluate bash commands, Claude Cowork uses a full virtual machine (VM) via the Apple Virtualization framework (macOS) or HCS (Windows).

Isolation: The VM has its own kernel and process table. Only the user-selected workspace is mounted; credentials remain in the host's keychain.
Architecture Evolution: The agent loop was moved outside the VM to ensure the product remains usable if the VM crashes, while code execution remains isolated inside the VM.
Egress Control: To prevent data exfiltration via approved domains (e.g., using an attacker's API key to upload files to api.anthropic.com), Anthropic implemented a man-in-the-middle proxy inside the VM that only allows requests carrying the VM's own provisioned session token.

Critical Security Failures and Lessons Learned

Anthropic identifies several "missed risks" that highlight the fragility of custom security components:

Pre-Trust Execution: In Claude Code, attackers could execute code via .claude/settings.json hooks before the user accepted the "Do you trust this folder?" prompt. The fix was to defer all project-local configuration parsing until after user consent.
Direct Prompt Injection: Red-teaming revealed that users could be phished into pasting prompts that exfiltrate credentials (e.g., ~/.aws/credentials). Since the user is the source of the prompt, model-layer classifiers cannot detect the intent. Only environmental egress controls and filesystem boundaries can stop this.
The Visibility Trade-off: High isolation (like the Cowork VM) makes the agent opaque to host-based Endpoint Detection and Response (EDR) software. Anthropic currently uses pull-based OTLP exports for event logs to provide administrators with post-hoc visibility.

Future Challenges in Agent Security

As agents evolve, Anthropic anticipates new attack vectors:

Persistent Memory Poisoning: Injections stored in product memory or CLAUDE.md files that are reloaded every session.
Multi-Agent Trust Escalation: The risk that a main agent trusts a sub-agent's output more than raw tool results, creating a new injection vector.
Agent Identity: Determining whether agents should have their own principal identities or inherit user permissions.

Community Insights and Counterpoints

Discussion among technical users suggests that while Anthropic's approach is robust, certain gaps remain:

"The proxy sits inside the VM rather than on our servers because only the VM knows provenance... That means the attacker can still exfiltrate files if they get root inside the VM."

Other users emphasized the danger of "probabilistic" guardrails, noting that Claude Code's auto-mode classifier has a ~17% false negative rate for overeager actions, which makes it a layer of defense-in-depth rather than a primary security boundary.

Summary of Containment Strategies

Environment	Ephemeral Container	HITL Sandbox	Sealed VM
Isolation Overhead	Container spin-up	Low-latency native sandbox	Full VM boot
User Reliance	N/A	High (must interpret bash)	N/A
Blast Radius	Server-side (gVisor)	Local workspace	Mounted workspace (Hypervisor)