Claude Code Sandboxing Update

Anthropic has introduced sandboxing for Claude Code to enhance security and autonomy. By implementing OS-level boundaries, the system reduces permission prompts by 84% in internal usage, mitigating the risk of prompt injection while allowing the agent to operate more freely within defined limits.

OS-Level Sandboxing Architecture

Claude Code utilizes OS-level primitives—specifically Linux bubblewrap and MacOS seatbelt—to enforce security boundaries. This architecture ensures that even in the event of a successful prompt injection, the agent remains isolated and cannot access sensitive system files or communicate with unauthorized servers.

Filesystem Isolation

Filesystem isolation restricts Claude Code's access to specific directories. The sandbox allows read and write access to the current working directory while blocking modification of any files outside that scope. This prevents a compromised agent from modifying sensitive system files or stealing SSH keys.

Network Isolation

Network isolation ensures that Claude Code can only connect to approved servers. All internet access is routed through a Unix domain socket connected to a proxy server running outside the sandbox. This proxy enforces domain restrictions and requires user confirmation for new domains, preventing the exfiltration of sensitive data or the downloading of malware.

New Sandboxing Features

Anthropic has released two primary implementations of this sandboxing technology:

Sandboxed Bash Tool

The sandboxed bash tool, available in beta as a research preview, allows Claude to execute commands without constant permission prompts. If the agent attempts to access resources outside the defined sandbox, the user is notified immediately.

This runtime is also available as an open-source research preview via the anthropic-experimental/sandbox-runtime GitHub repository to help other developers build safer agents.

Claude Code on the Web

Claude Code on the web provides an isolated cloud-based sandbox for each session. To protect sensitive credentials, the system ensures that git credentials and signing keys are never stored inside the sandbox.

Instead, a custom proxy service handles all git interactions. The git client inside the sandbox authenticates to this proxy using a scoped credential; the proxy then validates the interaction (e.g., verifying the branch destination) and attaches the necessary authentication token before forwarding the request to GitHub.

Implementation and Access

Developers can enable these features through the following methods:

• Local Sandboxing: Run the /sandbox command within Claude Code.
• Web-based Sandboxing: Access the tool via claude.com/code.
• Agent Development: Integrate the open-sourced sandbox-runtime into custom agentic workflows.