{"slug": "claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t", "title": "Claude Code shipped a sandbox. Here's what it protects — and what it doesn't.", "summary": "Anthropic shipped OS-level sandboxing for Claude Code, using Seatbelt on macOS and bubblewrap on Linux/WSL2. The sandbox constrains Bash commands and their child processes, but not Claude Code's Read, Edit, and Write tools, and it fails open if the sandbox cannot start. The docs are unusually honest about the limits, noting that reads are much wider than writes and that the working directory is inside the boundary by design.", "body_md": "Anthropic shipped OS-level sandboxing for Claude Code. If you run an agent\n\nagainst a repo you care about, it's worth understanding precisely what moved —\n\nbecause a fair amount of the commentary treats it as \"agents are contained\n\nnow,\" and that's not what the documentation says.\n\nI read the docs carefully, partly because I build a tool in adjacent territory\n\nand needed to know whether I'd just been made redundant. Short answer: no. The\n\nlonger answer is more interesting, and it starts with a compliment: **the docs\nare unusually honest about their own limits.** Most of what follows isn't\n\nThe sandbox uses OS primitives — Seatbelt on macOS, bubblewrap on Linux and\n\nWSL2. By default, sandboxed commands can write only to your working directory\n\nand the session temp directory. No network domains are pre-allowed: the first\n\ntime a command needs a new host you're prompted, and approving it lasts the\n\nsession.\n\nCrucially, this is enforced by the operating system on the *running process*,\n\nnot by the model correctly interpreting a command. The docs put it well: the\n\nboundary holds regardless of what the model chose to run, and even if an\n\nallowed command does more than its name suggests. That's a real improvement\n\nover asking an agent nicely, and it's the right layer for what it solves.\n\nThe motivation named in the docs is the same one I keep seeing in the wild:\n\nreducing the permission prompts that people stop reading. Approval fatigue is\n\nthe disease; this is a real treatment for part of it.\n\n**It's Bash-only.** The sandbox constrains Bash commands and their child\n\nprocesses. Claude Code's own Read, Edit and Write tools don't run through it —\n\nthey go through the permission system instead. \"The sandbox is on\" means shell\n\ncommands are contained, not that every file operation is.\n\n**Your working directory is inside the boundary by design.** The default write\n\nscope *is* the current working directory, plus session temp. That's what makes\n\nthe agent useful — it has to edit your code. It also means the sandbox is not\n\nprotecting the thing many developers assume it is. A destructive command\n\nconfined to your project is still confined to your project.\n\nThere's a sharp exception worth knowing, and it cuts in the reassuring\n\ndirection: even in auto-allow mode, `rm`\n\nand `rmdir`\n\ntargeting `/`\n\n, your home\n\ndirectory, or other critical system paths still trigger a prompt or a\n\nclassifier check, and explicit deny rules are always respected. Anthropic\n\nspecial-cased the catastrophic paths. Everything inside your working directory\n\nremains permitted, deliberately.\n\n**Reads are much wider than writes.** Default read access is the *entire\ncomputer* minus a few denied directories — and the docs say plainly that this\n\n`~/.aws/credentials`\n\nand`~/.ssh/`\n\n. If you want those protected you configure `sandbox.credentials`\n\n`denyRead`\n\n. There is no built-in credential deny**There's an escape hatch, on by default — but it's permissioned.** When a\n\ncommand fails because of sandbox restrictions, Claude may retry it with\n\n`dangerouslyDisableSandbox`\n\n. Importantly, that retry goes through the normal\n\npermission flow: a confirmation prompt in default mode, or the classifier in\n\nauto mode. So it isn't a silent bypass — it's a sanctioned door with a\n\ndoorbell. If you want the door bricked up, `allowUnsandboxedCommands: false`\n\nenables what the panel calls Strict sandbox mode.\n\n**It fails open.** If the sandbox can't start — missing bubblewrap, unsupported\n\nplatform — Claude Code warns and runs commands unsandboxed, unless you set\n\n`failIfUnavailable: true`\n\n. That's a defensible default (a safety layer that\n\nbricks your agent gets switched off, and then it protects nobody); I make the\n\nsame choice in my own tool. But fail-open has a shadow: the thing can be\n\ninactive while everything looks fine. I learned that expensively when a hook\n\nAPI rename left my own tool silently gating nothing for four minor versions,\n\nwith a fully green test suite.\n\n**And on native Windows it doesn't run at all.** Windows users are pointed at\n\nWSL2. If you run Claude Code natively on Windows — plenty do — the sandbox\n\nisn't in your picture.\n\nBefore I make my argument, the Limitations section deserves reading in full,\n\nbecause it's more candid than most vendor security pages:\n\n`github.com`\n\ncan create paths for data exfiltration, with domain\nfronting named explicitly.`allowUnixSockets`\n\ncan inadvertently grant host access: allowing\n`/var/run/docker.sock`\n\neffectively grants access to the host system.`allowAppleEvents`\n\non macOS removes code-execution isolation.`enableWeakerNestedSandbox`\n\nconsiderably weakens security.That's a vendor telling you where their boundary ends. Take them at their word\n\nrather than at the marketing.\n\nContainment, consequence and recovery are three different questions, and tools\n\ntend to answer exactly one:\n\n**Containment** asks *can this process touch things outside its box?* That's\n\nthe sandbox, Docker, seccomp. A boundary in space.\n\n**Consequence** asks *what will this specific command destroy if it runs?*\n\nFifty thousand rows. Three dependent tables. One commit that exists only on the\n\nremote. A containment boundary has no opinion about this, because a permitted\n\ncommand inside the boundary is just a permitted command.\n\n**Recovery** asks *and if it happens anyway, can I get it back?* Neither\n\ncontainment nor prediction gets you here. This is a backup taken before\n\nexecution, and a path back.\n\nThe failures I've been collecting all month live in the second and third\n\ncategories. An agent following NTFS junctions out of a `Windows.old`\n\ncleanup\n\ninto someone's live Documents folder. Prompt-configured rules — \"don't touch\n\n.env\" — ignored, because instructions are suggestions and the execution path\n\ndoesn't read your CLAUDE.md. `rm -rf ~/.crit/reviews/$SID`\n\nwhere `$SID`\n\nhad\n\nalready been cleared, so it expanded to nothing and took the parent directory.\n\nNotice what those share. None is an agent doing something obviously stupid.\n\nEach is a **correct-looking command whose real scope differs from its apparent\nscope.** Containment doesn't address that class, because the command was\n\n**Turn the sandbox on.** It's built in, OS-enforced, and it closes a real\n\ncategory. On Windows that means WSL2 or nothing — worth knowing before you\n\nassume you're covered.\n\n**Then convert three soft defaults into firm ones**, each a one-line change:\n\n```\n{\n  \"sandbox\": {\n    \"enabled\": true,\n    \"failIfUnavailable\": true,\n    \"allowUnsandboxedCommands\": false,\n    \"credentials\": {\n      \"files\": [\n        { \"path\": \"~/.aws/credentials\", \"mode\": \"deny\" },\n        { \"path\": \"~/.ssh\", \"mode\": \"deny\" }\n      ]\n    }\n  }\n}\n```\n\nKnow it's broken rather than assume it's working; make the boundary hold rather\n\nthan negotiate; and stop sandboxed commands reading your keys, since the\n\ndefault read policy allows it.\n\n**Then be clear-eyed that you've solved containment, not consequence or\nrecovery.** For those: least-privilege credentials — an agent token that\n\nThat last part is what I build ([Termaxa](https://github.com/termaxa/termaxa),\n\nopen source, Rust). I'm obviously not neutral. But the argument survives\n\nwithout it: vendors will keep shipping containment, because containment is what\n\na platform can own. Consequence and recovery sit at a different layer, and\n\nstructurally, no agent vendor is going to build that layer for their\n\ncompetitors' agents. Anthropic won't gate Cursor. Cursor won't gate Claude\n\nCode. If you run more than one, that layer has to come from somewhere else.\n\nClaude Code's sandbox is a good, real improvement that answers one of three\n\nquestions well, and its documentation is refreshingly clear about where it\n\nstops. It's Bash-scoped; reads are far wider than writes and include your\n\ncredentials by default; the escape hatch is on but permissioned; it fails open;\n\nand it isn't there at all on native Windows.\n\nRead the limitations section. Flip the flags that matter to you from soft to\n\nfirm. And keep a backup — because the thing that gets you won't look dangerous.\n\nIt'll look like a command you'd have approved.\n\n*Verified against Claude Code's sandboxing documentation, August 2026.\nIncidents referenced are public posts from r/ClaudeAI, r/ClaudeCode and\nr/cursor over the past two weeks. The docs move quickly; where this and the\ndocumentation disagree, the documentation is right and I'm out of date. Termaxa is MIT/Apache, *\n\n`cargo install termaxa`\n\n— and if you can get an agent past it in a way I haven't documented, that's the most useful thing you could send me:", "url": "https://wpnews.pro/news/claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t", "canonical_source": "https://dev.to/termaxa/claude-code-shipped-a-sandbox-heres-what-it-protects-and-what-it-doesnt-4o8h", "published_at": "2026-08-04 21:23:38+00:00", "updated_at": "2026-08-04 21:47:17.236800+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools"], "entities": ["Anthropic", "Claude Code", "Seatbelt", "bubblewrap"], "alternates": {"html": "https://wpnews.pro/news/claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t", "markdown": "https://wpnews.pro/news/claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t.md", "text": "https://wpnews.pro/news/claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t.txt", "jsonld": "https://wpnews.pro/news/claude-code-shipped-a-sandbox-here-s-what-it-protects-and-what-it-doesn-t.jsonld"}}