Claude Code Sandboxing

Anthropic's Claude Code sandbox lets commands run within predefined filesystem and network boundaries, reducing the need to approve each operation. Operating-system controls also cover programs launched by those commands. The described configuration permits writes in the working directory, restricts writes elsewhere and routes network requests through a proxy that limits reachable domains. Both boundaries matter: file restrictions constrain what a compromised command can change, while network restrictions constrain where it can send information. The company reports 84% fewer permission prompts in internal use, a result specific to its own usage.

“In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%.”

“Sandboxing ensures that even a successful prompt injection is fully isolated, and cannot impact overall user security.”

“This way, a compromised Claude Code can't steal your SSH keys, or phone home to an attacker's server.”

“Without network isolation, a compromised agent could exfiltrate sensitive files like SSH keys; without filesystem isolation, a compromised agent could easily escape the sandbox and gain network access.”