Anthropic Details How It Contains Claude Across Web, Code, and Cowork
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Anthropic's detailed containment architectures for agents are highly technical, novel, and strategically important for AI safety.
Anthropic's containment for Claude uses deterministic environmental limits—gVisor for web, Seatbelt/bubblewrap for Claude Code, VM for Cowork—rather than relying on model safeguards or permission prompts. Claude Code's shift from per-action approval (93% user approval) to OS-level sandbox cut prompts by 84%, but incidents like a .claude/settings.json hook executing before trust and a phishing exfiltration (24/25 success) exposed gaps. A third-party disclosure showed a malicious file could exfiltrate workspace files via the allowlisted Files API, underscoring that allowlists alone are insufficient.