How we contain Claude across products
02:00 · May 25, 2026 · Antropic Engineering Blog
As agents grow more capable, so does their potential blast radius. The engineering question is how to cap it. Here’s what we’ve learned building containment for claude.ai, Claude Code, and Cowork.\n
Summary
Anthropic has shifted from cautious experiments to routine deployment of Claude agents with broad access to internal services, making containment essential to limit potential damage. The company identifies three overlapping risk categories—user misuse, model misbehavior, and external attacks through tools or content—and counters them with defenses applied to the runtime environment, the model itself, and the external data the agent can reach. Environmental controls receive the heaviest investment because they set hard boundaries that remain effective even when model safeguards or user oversight fall short.
For claude.ai, code execution occurs inside gVisor containers on isolated infrastructure. Sessions are ephemeral, the filesystem does not persist, and no code runs on user devices, which keeps the blast radius small at the cost of limited workspace persistence. Claude Code, by contrast, must operate on the developer’s local machine and filesystem. Early versions relied on per-action permission prompts, but usage data revealed users approved roughly 93 percent of requests, leading to fatigue. The team therefore introduced OS-level sandboxes—Seatbelt on macOS and bubblewrap on Linux—that allow reads and workspace writes while denying network access by default, cutting prompts by 84 percent.
Claude Cowork uses local virtual machines to give agents more capability while still containing them from the host. Several incidents exposed gaps in these designs. Attackers could execute code before the user accepted a trust dialog by embedding hooks in project configuration files. Another exercise showed an agent could be tricked into reading credentials and exfiltrating them through an approved domain because egress controls had not been tightened sufficiently. In the VM case, strong isolation also prevented endpoint detection tools from observing agent behavior.
These examples illustrate that defenses must be layered and that each new capability introduces fresh attack surfaces. Model-layer measures such as classifiers and training adjustments reduce but never eliminate risk, while external connectors can deliver poisoned content even after malware scanning. The practical lesson is that containment architectures must be tailored to the product’s threat model and user expertise, with environmental boundaries providing the most reliable way to cap blast radius as agent capabilities continue to grow.
Why it matters
Highly actionable for Product Teams and Builders: provides concrete implementation patterns, risk trade-offs, and lessons on agent security that directly apply to building safe AI products. Addresses limitations, prompt injection, and oversight fatigue with measurable outcomes.
