Making Claude Code more secure and autonomous with sandboxing (www.anthropic.com)

Anthropic announced sandboxing for Claude Code — a set of OS-level controls that let the coding assistant run more autonomously while dramatically reducing risky permission prompts (internal tests show an 84% drop). Sandboxing addresses “approval fatigue” by defining explicit boundaries so Claude can read, edit, and run commands inside allowed areas without asking for every action. The goal: faster developer workflows with stronger protections against prompt injection, exfiltration, and unauthorized changes. Technically, the sandbox enforces both filesystem and network isolation (both are required to stop escapes or data leaks). A beta “sandboxed bash” runtime (open source research preview) uses Linux bubblewrap and macOS seatbelt to restrict processes: read/write is limited to chosen directories and any outside access triggers a user notification. Network access is routed through a unix-domain-socket proxy outside the sandbox that enforces allowed domains and handles user confirmations; the proxy is customizable for stricter policies. Claude Code on the web runs each session in an isolated cloud sandbox where sensitive credentials never sit with the agent — git operations use a proxy with scoped credentials that verify branch and payload before attaching tokens. To try it, run /sandbox in Claude, visit claude.com/code, or inspect the open-source runtime to integrate sandboxing into your own agents.