Claude Code shipped a sandbox. Here's what it protects — and what it doesn't.
Anthropic shipped OS-level sandboxing for Claude Code. If you run an agent against a repo you care about, it's worth understanding precisely what moved — because a fair amount of the commentary treats it as "agents are contained now," and that's not what the documentation says. I read the docs carefully, partly because I build a tool in adjacent territory and needed to know whether I'd just been…
Anthropic has introduced OS-level sandboxing for Claude Code, which aims to protect developers and their code from potential harm caused by unauthorized actions. However, it is crucial to understand the limitations of this sandboxing mechanism before relying on it entirely.
The sandbox utilizes OS primitives like Seatbelt on macOS, bubblewrap on Linux, and WSL2. By default, it restricts commands from writing outside the working directory and session temp directory, preventing unauthorized network access. The sandbox enforces these boundaries directly on the operating system level, not depending on the model's interpretation of the commands.
Despite these protections, the sandbox is Bash-only and only applies to Bash commands and their child processes. Claude Code's Read, Edit, and Write tools bypass the sandbox, operating through the standard permission system instead. The sandboxed working directory has a default write scope limited to the current directory and session temp, which is essential for the agent's functionality but does not protect the broader codebase.
There is an exception to consider: the sandbox can be overridden for critical system paths such as /, /home/, or /etc/, which still trigger prompts or classifier checks and respect explicit deny rules. However, reads are much broader than writes, allowing access to credential files like ~/.aws/credentials and ~/.ssh/.
When a command fails due to sandbox restrictions, Claude Code may retry it with dangerouslyDisableSandbox, but this retry still goes through the normal permission flow. To prevent accidental disabling of the sandbox, users can set allowUnsandboxedCommands: false, enabling Strict sandbox mode, which fails open by default.
While the sandbox significantly reduces risk, it is not a complete isolation boundary. Users should be aware of potential gaps, such as the proxy's inability to terminate or inspect TLS, allowing broad domains like github.com to create paths for data exfiltration. Additionally, allowing Unix sockets or enabling weaker nested sandbox modes may further compromise security.
In conclusion, Anthropic's OS-level sandboxing for Claude Code provides valuable protection, but developers should understand its limitations and take necessary precautions to ensure the safety of their code and data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
