Anthropic's sandbox strategy for Claude — detailed & open
Anthropic published a comprehensive guide to how they sandbox Claude across three products: Claude.ai, Claude Code, and Cowork.
The approach stacks multiple layers—process isolation, VMs, filesystem boundaries, egress controls—so credentials and sensitive resources never reach the sandbox in the first place, closing off exfiltration even if the model finds a “creative“ path.
• Claude.ai uses gVisor for containerization
• Claude Code (local) uses Seatbelt on macOS and Bubblewrap on Linux
• Hard boundaries prevent agent escape, regardless of cause