Beyond permission prompts: making Claude Code more secure and autonomous
02:00 · October 20, 2025 · Antropic Engineering Blog

Claude Code's new sandboxing features, a bash tool and Claude Code on the web, reduce permission prompts and increase user safety by enabling two boundaries: filesystem and network isolation.
Summary
Anthropic has introduced sandboxing mechanisms in Claude Code to limit the risks that arise when the agent navigates codebases, edits files, and executes commands. The system replaces the default read-only permission model, which required repeated user approvals and risked approval fatigue, with predefined boundaries that allow safer autonomous operation. In internal tests the change reduced permission prompts by 84 percent while still blocking unauthorized actions.
The sandbox enforces both filesystem and network isolation through operating-system primitives. On Linux it relies on bubblewrap; on macOS it uses seatbelt. These controls apply not only to direct tool calls but also to any scripts or subprocesses they spawn. A new open-source sandbox runtime, released as a research preview, lets users specify exact directories and permitted network hosts without launching containers. The same runtime now wraps the bash tool inside Claude Code, so commands execute within the declared limits and any attempt to reach outside triggers an immediate prompt.
A second offering, Claude Code on the web, runs each session inside an isolated cloud environment. Sensitive credentials such as git tokens or signing keys remain outside the sandbox. Git operations are routed through a custom proxy that validates scoped credentials and enforces branch restrictions before forwarding requests to the remote repository. Together the two features give developers a practical way to run agentic coding sessions with reduced manual oversight while containing the impact of prompt-injection attacks.
Why it matters
Provides actionable security architecture and open-source components for building safer AI coding agents, directly applicable to product teams implementing autonomous workflows. Addresses real risks like data exfiltration with concrete isolation boundaries and measurable prompt reduction. Open-sourcing enables Dutch builders to integrate similar controls into their own agents.





