Photo: Merlin Lightpainting / Pexels
The new feature uses OS-level isolation to lock down command execution, cutting permission prompts by 84% since initial development began.
Anthropic has rolled out a local Bash sandbox mode for Claude Code on desktop, giving the AI coding tool a security upgrade that isolates command execution at the operating system level. The feature works on macOS and Linux/WSL2, using native sandboxing technologies to restrict what Claude Code can actually touch on your machine.
How the sandbox actually works #
The technical implementation varies by platform. On macOS, the sandbox relies on Seatbelt, Apple’s built-in sandboxing framework that enforces fine-grained restrictions on process-level access. Linux and WSL2 users get bubblewrap, a lightweight containerization tool commonly used in the Linux ecosystem for unprivileged sandboxing.
Both approaches accomplish the same goal: filesystem access gets locked down to the current working directory and its children, while network requests pass through a proxy layer that only permits connections to pre-approved domains.
Windows users, for now, are left out. Full native support for Windows remains absent.
The sandbox ships with two operational modes. The first is auto-allow, which lets commands execute without requiring explicit user approval each time. The second is a traditional permissions mode that still gates every command behind a manual check.
Since Anthropic began iterating on this sandbox approach around October 2025, the company says it has achieved an 84% reduction in permission prompts.
Security context and prompt injection defense #
The sandbox addresses a real and growing attack surface: prompt injection. A carefully crafted prompt injection could trick an AI assistant into running destructive commands, exfiltrating sensitive files, or establishing unauthorized network connections. The sandbox’s filesystem restrictions and network allowlists serve as guardrails against exactly these scenarios.
By confining execution to the working directory, even a successful prompt injection attack would struggle to reach SSH keys, environment variables, browser cookies, or other sensitive data stored elsewhere on the system. The network proxy adds a second layer, preventing exfiltration attempts to unauthorized domains.
Anthropic’s documentation makes clear that “computer use” features — the desktop interaction capabilities that let Claude control mouse clicks and screen interactions — run outside the sandbox environment. This means developers using those features still operate without the isolation protections the sandbox provides.
The broader AI coding tool landscape #
Anthropic’s sandbox development fits into a broader strategy that began taking shape in 2025, when the company started positioning Claude Code as a multi-functional development environment where AI can autonomously write, test, and execute code.
The company also supports third-party sandboxing options, including Docker-based isolation, for users who want stronger separation between Claude Code’s execution environment and their host system. Docker sandboxes offer a more comprehensive isolation layer than OS-level tools like Seatbelt or bubblewrap, though they come with additional setup overhead and resource consumption.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our