Chronicle/Defense & research

Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime

Oct 20, 2025DefenseTool releaseSignificance assistant-drafted

Anthropic describes sandboxing for Claude Code that restricts file writes to permitted directories and routes network traffic through a proxy that only allows approved hosts, so a prompt-injected agent cannot modify sensitive files or exfiltrate data freely. Anthropic says internal use showed an 84% reduction in permission prompts, and it released the sandbox runtime, built on bubblewrap and macOS seatbelt, as an open-source research preview.

Why it matters

It is a concrete containment control that limits the blast radius of prompt injection in coding agents regardless of model behavior.

Key facts

As stated in the sources, with where to find them.

Anthropic reports sandboxing safely reduced permission prompts by 84% in internal usage.Main post
Runtime released as anthropic-experimental/sandbox-runtime, using Linux bubblewrap and macOS seatbelt.Open source section

Findings that cite this record

Oct 20, 2025

Operating-system sandboxing can cut the number of approval prompts a coding agent needs without widening what injected instructions can reach.

Reportedreported1 evidence record

Key questions this bears on

Can AI agents defend and oversee systems on their own?Not yet. Agents are weak on realistic defensive benchmarks and monitors can be evaded; assistants help analysts who stay in charge.

Sources

Beyond permission prompts: making Claude Code more secure and autonomousAnthropicOct 20, 2025Primary sourceAccessed Sep 25, 2026

Related records

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

AttackVulnerability disclosureTracebit, Google

Aug 4, 2026

UK AISI reports 19 unsanctioned real-world agent actions during internet-enabled cyber range testing

AttackIncidentUK AI Security Institute, Anthropic, OpenAI

Jun 3, 2026

Frontier Model Forum issue brief catalogs emerging security practices for AI agents

PolicyGuidanceFrontier Model Forum

Jan 8, 2026

NIST CAISI requests public input on security considerations for AI agent systems

PolicyProgramUS Center for AI Standards and Innovation, NIST

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Organizations: Anthropic
Topics: Sandbox & containment Prompt injection Data exfiltration
Attack surface: Execution sandbox Credentials Human approver
Methods: Data exfiltration through agents Human approval gates Sandboxing and egress control
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity
Record: anthropic-claude-code-sandboxing-2025 · added 2026-09-25

Cite this record

Fide AI. "Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime." Agentic Cyber Explorer, record anthropic-claude-code-sandboxing-2025. https://agentic-cyber-explorer.pages.dev/events/anthropic-claude-code-sandboxing-2025/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-anthropic-claude-code-sandboxing-2025,
  author = {{Fide AI}},
  title = {Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/anthropic-claude-code-sandboxing-2025/},
  note = {Record anthropic-claude-code-sandboxing-2025; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.