Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers

Anthropic has open-sourced sandbox-runtime, or srt, the OS-level sandbox that sits behind Claude Code's sandboxed bash tool. It limits which files a process can touch and which hosts it can reach, and it does that without a container. It isn't tied to Claude Code either: any agent, local MCP server or ordinary command-line program can run inside it.

This matters because agents now run real commands on real machines. A prompt-injected agent with open access to a laptop can read SSH keys and send them somewhere. A boundary that is cheap enough to use everywhere changes the default from trust-and-hope to fenced-by-design.

We like this release, and we like that it's general purpose. Agent safety tooling locked inside one vendor's product helps that vendor's customers. A small, Apache-licensed package that wraps any process helps everyone running local agents, including people building on competing models.

The design argument is the strongest part. Anthropic's position is that one boundary without the other fails: without network isolation, a hijacked agent can exfiltrate secrets; without filesystem isolation, it can tamper its way out and get network access anyway. So srt does both and makes the defaults lopsided on purpose. Reads are allowed unless denied. Writes are denied unless allowed. Network is denied unless a domain is on the list, and all traffic leaves through proxies on the host that enforce that list.

The headline number is an 84% drop in permission prompts in Anthropic's internal Claude Code usage. That's self-reported, not an outside benchmark, and we'd treat it that way. But the problem it targets is real. Approval fatigue is a security hole. People who click approve all day stop reading what they approve. A fixed boundary that lets the agent work freely inside and only asks at the edge is a better human interface than a hundred pop-ups.

Now the eyes-open part. The sandbox is only as good as its allowlist, and the source itself says plainly that broad domains can leak data. Coding agents install packages, pull docs and hit APIs. Make the list strict and npm install breaks; make it loose and the fence is decorative. The pressure in every team will run toward loose, because broken builds are visible and quiet exfiltration isn't. If this pattern scales without discipline, we end up with a lot of agents that are technically sandboxed and practically open.

It's also a beta research preview, with Windows support in alpha. I'm encouraged by the thoughtful extras, like checks that block allowed names resolving to loopback or cloud metadata addresses, and denial messages that steer the agent to a sanctioned alternative. Those are signs of people who have watched agents misbehave. We'd still want independent security review before anyone treats srt as a hard boundary for hostile code.

On macOS, srt generates Seatbelt profiles for sandbox-exec; on Linux it uses bubblewrap and also needs socat and ripgrep; on Windows it uses a dedicated account, a Windows Filtering Platform egress fence and file ACLs. It ships as an npm package that works as both a CLI and a TypeScript library. The field it joins includes OpenAI's Codex CLI sandbox, which also uses OS primitives, and microVM-based options such as Docker Sandboxes and E2B.