How Anthropic Contains Claude: The Sandboxing Architecture Across Its Product Line
Agentic AIAnthropic has published a detailed breakdown of how it contains Claude agents across its product line — and the architecture is more specific than most security-conscious developers apply to their own agentic deployments.
The Layered Containment Model
The approach is consistent across products: process sandboxing, filesystem boundaries, egress controls, and credential isolation. What differs by product is the specific mechanism:
Claude.ai: Uses gVisor containerization — a user-space kernel that intercepts system calls and prevents container escape through kernel exploits. It’s the same containment layer used in Google Cloud Run.
Claude Code (local execution): Seatbelt on macOS, Bubblewrap on Linux. Both create unprivileged sandboxed environments where the agent’s file access and network egress are constrained to explicitly permitted paths.
Claude Cowork: Full virtual machine isolation — Apple Virtualization framework on macOS, HCS on Windows. The strongest boundary available: a complete guest OS separating agent execution from the host.
What the Sandbox Actually Prevents
The sandbox sets a hard boundary on what an agent can reach, regardless of whether problematic behavior originates from user instructions, model outputs, or adversarial prompt injection attacks. This matters because the threat model for production agents includes all three. An agent with broad filesystem access and live credentials that receives a malicious prompt can exfiltrate data regardless of its training — the sandbox prevents this at the infrastructure layer.
Anthropic previously identified and patched an api.anthropic.com/v1/files exfiltration vulnerability — a concrete example of the kind of risk that sandbox design prevents at the architectural level rather than relying on model training alone. The credential isolation principle — keeping sensitive credentials outside the sandbox entirely — addresses the most common real-world attack vector against deployed agents.
The parallel with developer-side sandboxing is direct: the tools differ (Sandvault vs gVisor vs Bubblewrap vs VMs) but the principles are identical — unprivileged execution, restricted filesystem scope, credential isolation, and egress control. The difference is Anthropic applies this at the platform level; developers applying it themselves at the tooling level add defense in depth.
The So What
The publication of this architecture by Anthropic is useful for two reasons. First, it establishes that the model provider itself treats agent containment as a security engineering problem, not a training problem — the sandbox catches what alignment doesn’t. Second, it gives enterprise security teams a reference architecture for evaluating whether their own Claude deployments need additional isolation. If your agents run with broader permissions than gVisor + egress control + credential isolation provides by default, the gap is worth examining.
Source: Simon Willison's Weblog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →