Simon Willison, a well-known figure in the developer community, recently highlighted a common frustration with sandboxing products: they often lack thorough documentation. Without clear details, it becomes difficult to trust how well a system actually contains potential threats. But Willison points to a new publication from Anthropic that addresses this gap head-on.
Anthropic has released a comprehensive overview of the sandbox techniques used across its three main Claude products: Claude.ai, Claude Code, and Claude Cowork. The documentation explains how the company constrains where and how an AI agent can act, using a combination of process sandboxes, virtual machines, filesystem boundaries, and egress controls. The stated goal is to set a hard boundary on what an agent can reach, so that even if credentials never enter the sandbox, they cannot be exfiltrated.
A System of Multiple Layers
The report breaks down the specific technologies employed for each product. Claude.ai, the web-based interface, uses gVisor, a container runtime sandbox developed by Google. For Claude Code, which runs locally on a user's machine, the sandboxing approach differs by operating system: on macOS it uses Apple's Seatbelt sandbox, and on Linux it uses Bubblewrap. Claude Cowork, which appears to be a more collaborative or enterprise offering, runs inside a full virtual machine. On macOS that VM uses Apple's Virtualization framework, while on Windows it relies on Microsoft's Hyper-V Container Services (HCS).
This layered approach is designed to limit the damage even if a model finds an unexpected or creative path to escape its intended constraints. Willison notes that the documentation is refreshingly transparent, including some stories of risks that Anthropic initially missed.
Missed Risks and a Matured Tool
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
One specific vulnerability mentioned is the api.anthropic.com/v1/files exfiltration vector, which was covered previously on Willison's blog. The fact that Anthropic publicly acknowledges such past mistakes adds credibility to the new documentation.
Willison also reminds readers about Anthropic's open-source sandbox runtime tool, simply called SRT (Anthropic Sandbox Runtime). He notes that the tool has matured to a point where he is now ready to give it a proper try. SRT is designed to provide a sandboxed environment for running AI agents, and its open-source nature allows developers to inspect and trust its implementation.
Why This Matters
For developers and organizations deploying AI agents, understanding the security boundaries is critical. With the rise of code-executing agents like Claude Code, the ability to contain an agent's actions is as important as the model's intelligence. Anthropic's willingness to publish detailed, technical documentation sets a standard for transparency that other companies may be encouraged to follow.
The entire post serves as a link to Anthropic's official documentation, and Willison's commentary provides a developer's perspective on why such documentation is valuable. It underscores a broader principle in AI safety: trust must be earned through openness, not just claimed through marketing.
Related on Neura Market
- AI Tools Directory - Browse and compare developer tools for AI safety and sandboxing.
- Automation Marketplace - Find workflows and automations that respect security boundaries.
- Platform Directory - Explore platforms like Claude and other AI assistants with documented security practices.