Meet Anthropic’s sandbox-runtime: OS-Degree Sandboxing for AI Brokers, No Containers

On this article, we’ll talk about newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash software. The Anthropic sandbox-runtime limits which information a course of can contact and which hosts it may attain. It does this with out spinning up a container. It’s also not tied to Claude Code. Your personal brokers, native MCP servers and plain command-line packages can run inside it.

TL;DR

Measurement: npm package deal @anthropic-ai/sandbox-runtime v0.0.81, about 11.4 MB unpacked, Apache-2.0, Node.js 22.12+.
Runs on: any macOS or Linux dev machine or CI field. macOS makes use of Seatbelt; Linux wants bubblewrap, socat and ripgrep. Home windows is alpha.
Efficiency: sandboxing lower Claude Code permission prompts by 84% in Anthropic’s inside utilization (self-reported).
Greatest: 84% fewer permission prompts, with file and community limits enforced on the entire course of tree.
Worst: nonetheless a beta analysis preview, Home windows assist is alpha.

What’s Anthropic sandbox-runtime?

Anthropic sandbox-runtime is an open-source software that wraps any course of in filesystem and community restrictions. You put in it with npm set up -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It really works as a CLI and as a TypeScript library.

How does sandbox-runtime work on macOS, Linux and Home windows?

srt makes use of every working system’s personal isolation primitives. Its restrictions cowl the complete course of tree, together with scripts and subprocesses.

macOS: sandbox-exec with dynamically generated Seatbelt profiles. Solely ripgrep is required.
Linux: bubblewrap with the community namespace eliminated. It additionally wants socat and ripgrep.
Home windows (alpha): a devoted srt-sandbox account, a Home windows Filtering Platform egress fence and specific file ACLs.

Site visitors leaves solely by HTTP and SOCKS5 proxies working on the host. On Linux, these proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile permits just one localhost port. The proxies then apply your area allowlist and denylist.

Why does it want each filesystem and community isolation?

Anthropic crew argues that 1 boundary with out the opposite fails. With out community isolation, a prompt-injected agent might exfiltrate SSH keys. With out filesystem isolation, it might escape the sandbox and achieve community entry.

srt’s defaults observe that logic. Reads are allowed in all places until denied. Writes are denied in all places until allowed. Community entry is denied until a site is allowlisted.

How do you sandbox an MCP server or your individual agent?

For an MCP server, change the command in .mcp.json from npx to srt. Cross the unique command as arguments. Guidelines then stay in ~/.srt-settings.json:

Copy Code

{
  "community": { "allowedDomains": ["api.github.com", "*.npmjs.org"], "deniedDomains": [] },
  "filesystem": { "denyRead": ["~/.ssh"], "allowWrite": ["."], "denyWrite": [".env"] }
}

On your personal agent, the library exposes SandboxManager. Name initialize(config) to begin the proxies. Then wrapWithSandbox() returns a wrapped command string you’ll be able to spawn.

What does the 84% determine imply?

Anthropic reports that sandboxing diminished permission prompts by 84% in inside Claude Code utilization. That may be a self-reported quantity, not an exterior benchmark. The goal is approval fatigue. Builders who click on “approve” all day cease studying what they approve. A set boundary lets the agent work freely inside it and ask solely on the edge.

<div class="pane on" id="p-flow">
<div class="circulation">
<div class="node" data-n="0"><b>Agent / course of</b><small>Claude Code, MCP server, any CLI</small></div>
<div class="node" data-n="1"><b>srt wrapper</b><small>reads ~/.srt-settings.json</small></div>
<div class="node" data-n="2"><b>OS boundary</b><small>Seatbelt · bubblewrap · WFP</small></div>
<div class="node" data-n="3"><b>Host proxy</b><small>HTTP + SOCKS5</small></div>
<div class="node" data-n="4"><b>Allowlist test</b><small>enable · deny · ask</small></div>
</div>
<div class="observe"><div class="pkt" id="pkt"></div></div>
<div class="desc" id="fdesc"></div>
<div class="ctrl">
<button class="btn" id="fprev"> Again</button>
<button class="btn pri" id="fnext">Subsequent step </button>
<button class="btn" id="fplay">Auto-play</button>
</div>
</div>

<div class="pane" id="p-sim">
<div class="sim">
<div>
<div class="card">
<h5>community.allowedDomains</h5>
<label class="chk"><enter kind="checkbox" id="d-anth" checked> anthropic.com</label>
<label class="chk"><enter kind="checkbox" id="d-npm"> *.npmjs.org</label>
<label class="chk"><enter kind="checkbox" id="d-gh"> github.com</label>
<h5 fashion="margin-top:12px">filesystem</h5>
<label class="chk"><enter kind="checkbox" id="f-ssh" checked> denyRead: ~/.ssh</label>
<label class="chk"><enter kind="checkbox" id="f-env" checked> denyWrite: .env</label>
</div>
</div>
<div>
<div class="cmds" id="cmds">
<button class="cmd" data-c="0">srt "cat README.md"</button>
<button class="cmd" data-c="1">srt "cat ~/.ssh/id_rsa"</button>
<button class="cmd" data-c="2">srt "curl anthropic.com"</button>
<button class="cmd" data-c="3">srt "curl instance.com"</button>
<button class="cmd" data-c="4">srt "npm set up"</button>
<button class="cmd" data-c="5">srt "echo KEY=1 >> .env"</button>
</div>
<div class="time period" id="time period" fashion="margin-top:10px"><span class="dim">Decide a command. Toggle the config to see what adjustments.</span></div>
<div class="why" id="why"></div>
</div>
</div>
</div>

<div class="pane" id="p-plat">
<div class="plat">
<div class="laptop on" data-p="0"><h4>macOS</h4><span class="tag t-g">Supported</span><ul><li>sandbox-exec</li><li>Seatbelt profiles</li><li>Wants ripgrep</li></ul></div>
<div class="laptop" data-p="1"><h4>Linux</h4><span class="tag t-g">Supported</span><ul><li>bubblewrap</li><li>No community namespace</li><li>socat + ripgrep</li></ul></div>
<div class="laptop" data-p="2"><h4>Home windows</h4><span class="tag t-o">Alpha</span><ul><li>srt-sandbox account</li><li>WFP egress fence</li><li>One-time set up</li></ul></div>
</div>
<div class="desc pdetail" id="pdesc"></div>
</div>

<div class="pane" id="p-defs">
<div class="defs">
<div class="dc"><div class="kicker">Learn</div><div class="massive" fashion="coloration:#b5cc94">Enable</div><p>Allowed in all places by default. Deny areas like ~/.ssh, re-allow with allowRead.</p></div>
<div class="dc"><div class="kicker">Write</div><div class="massive" fashion="coloration:#ef7a73">Deny</div><p>Denied in all places by default. Open paths like "." and /tmp with allowWrite.</p></div>
<div class="dc"><div class="kicker">Community</div><div class="massive" fashion="coloration:#ef7a73">Deny</div><p>No entry by default. Each host should match allowedDomains.</p></div>
</div>
<div class="bars" id="bars">
<div class="kicker" fashion="margin-bottom:4px">Claude Code permission prompts (listed)</div>
<div class="bar"><div class="lb"><span>With out sandboxing</span><span>100</span></div><div class="bg"><div class="fg" data-w="100" fashion="background:var(–muted)"></div></div></div>
<div class="bar"><div class="lb"><span>With sandboxing</span><span>16</span></div><div class="bg"><div class="fg" data-w="16" fashion="background:var(–orange)"></div></div></div>
<div class="be aware">84% fewer prompts in Anthropic’s inside utilization (self-reported, Oct 2025 engineering submit). Listed to 100.</div>
</div>
</div>

<div class="pane" id="p-cmp">
<div class="tblwrap">
<desk>
<thead><tr><th></th><th>srt</th><th>Codex CLI</th><th>Docker Sandboxes</th><th>E2B</th></tr></thead>
<tbody>
<tr class="row"><td>Isolation</td><td class="hl">OS primitives</td><td>OS primitives</td><td>microVM</td><td>Firecracker microVM</td></tr>
<tr class="row"><td>Runs</td><td class="hl">Native</td><td>Native</td><td>Native</td><td>Cloud / BYOC</td></tr>
<tr class="row"><td>Container or VM</td><td class="hl">No</td><td>No</td><td>Sure</td><td>Sure</td></tr>
<tr class="row"><td>Community default</td><td class="hl">Deny all</td><td>Off (toggle)</td><td>Chosen coverage</td><td>On</td></tr>
<tr class="row"><td>Area allowlist</td><td class="hl">Wildcards + ports</td><td>Not disclosed</td><td>Wildcards + ports</td><td>allowOut, wildcards</td></tr>
<tr class="row"><td>License</td><td class="hl">Apache-2.0</td><td>Apache-2.0</td><td>Not disclosed</td><td>Apache-2.0 (SDK)</td></tr>
</tbody>
</desk>
</div>
</div>

<div class="ft"><span>Sources: github.com/anthropics/sandbox-runtime · anthropic.com/engineering · v0.0.81</span><span class="mtp">Constructed by Marktechpost</span></div>
</div>
<script>
(operate(){
var R=doc.getElementById(‘srt-x’);
operate submit(){attempt{mother or father.postMessage({srtH:R.offsetHeight+40},’*’)}catch(e){}}
var tabs=R.querySelectorAll(‘.tab’);
tabs.forEach(operate(b){b.addEventListener(‘click on’,operate(){
tabs.forEach(operate(x){x.classList.take away(‘on’)});b.classList.add(‘on’);
R.querySelectorAll(‘.pane’).forEach(operate(p){p.classList.take away(‘on’)});
var t=b.getAttribute(‘data-t’);doc.getElementById(‘p-‘+t).classList.add(‘on’);
if(t===’defs’)bars();if(t===’cmp’)rows();setTimeout(submit,60);
})});
// circulation
var steps=[
[‘Your agent runs a command’,’The agent, MCP server or CLI tool issues a command. It is unchanged; srt simply wraps it.’,0,’act’],
[‘srt builds the policy’,’srt loads ~/.srt-settings.json (or built-in defaults) and starts HTTP and SOCKS5 proxies on the host.’,1,’act’],
[‘The OS enforces the boundary’,’Seatbelt (macOS), bubblewrap (Linux) or a WFP fence (Windows alpha) applies file rules to the whole process tree.’,2,’act’],
[‘All traffic goes through the proxy’,’The sandbox has no direct route out. On Linux, the network namespace is removed; proxies are reached via Unix sockets.’,3,’act’],
[‘Allowed host: connection proceeds’,’A host in allowedDomains passes, after a check that it does not resolve to loopback or cloud metadata IPs.’,4,’ok’],
[‘Unknown host: blocked or asked’,’A denied or unlisted host is refused, or an ask callback decides. The violation is logged for the agent to read.’,4,’bad’]
];
var fi=0,timer=null;
operate draw(){
var s=steps[fi];var ns=R.querySelectorAll(‘.node’);
ns.forEach(operate(n,i){n.classList.take away(‘act’,’okay’,’dangerous’);if(i<s[2])n.classList.add(‘act’)});
ns[s[2]].classList.add(s[3]);
var pk=doc.getElementById(‘pkt’);pk.fashion.left=(s[2]*22)+’%’;
pk.fashion.background=s[3]===’okay’?’#788c5d’:s[3]===’dangerous’?’#d4504a’:’#d97757′;
doc.getElementById(‘fdesc’).innerHTML='<h4>Step ‘+(fi+1)+’ of ‘+steps.size+’: ‘+s[0]+'</h4>’+s[1];
}
doc.getElementById(‘fnext’).onclick=operate(){fi=(fi+1)%steps.size;draw()};
doc.getElementById(‘fprev’).onclick=operate(){fi=(fi-1+steps.size)%steps.size;draw()};
doc.getElementById(‘fplay’).onclick=operate(){
if(timer){clearInterval(timer);timer=null;this.textContent=”Auto-play”;return}
this.textContent=”Pause”;timer=setInterval(operate(){fi=(fi+1)%steps.size;draw()},1800);
};
draw();
// sim
operate on(id){return doc.getElementById(id).checked}
var C=[
function(){return [1,’# Anthropic Sandbox Runtime (srt) …’,’Reads are allowed by default, and the current directory is readable.’]},
operate(){return on(‘f-ssh’)?[0,’cat: ~/.ssh/id_rsa: Operation not permitted’,’~/.ssh is in denyRead, so the key cannot be read.’]:[1,’—–BEGIN OPENSSH PRIVATE KEY—– …’,’Without a denyRead rule, reads are open everywhere. Deny secrets explicitly.’]},
operate(){return on(‘d-anth’)?[1,'<html>…</html>’,’anthropic.com is in allowedDomains, so the proxy forwards it.’]:[0,’Connection blocked by network allowlist’,’No allowlist match: network is deny-by-default.’]},
operate(){return [0,’Connection blocked by network allowlist’,’example.com is not allowlisted.’]},
operate(){return on(‘d-npm’)?[1,’packages installed (illustrative output)’,’*.npmjs.org is allowlisted, so the registry is reachable.’]:[0,’npm ERR! network request to registry.npmjs.org failednConnection blocked by network allowlist’,’The classic trade-off: too strict, and installs fail.’]},
operate(){return on(‘f-env’)?[0,’bash: .env: Operation not permitted’,’denyWrite beats allowWrite, so .env stays protected inside the project.’]:[1,'(written)’,’"." is in allowWrite, so the write succeeds.’]}
];
var busy=false;
R.querySelectorAll(‘.cmd’).forEach(operate(b){b.addEventListener(‘click on’,operate(){
if(busy)return;busy=true;var r=C[+b.getAttribute(‘data-c’)]();var t=doc.getElementById(‘time period’);
t.innerHTML='<span class="p">$</span> ‘+b.textContent.change(/</g,’<’)+’n<span class="dim">Operating inside sandbox…</span>’;
doc.getElementById(‘why’).textContent=””;
setTimeout(operate(){
t.innerHTML='<span class="p">$</span> ‘+b.textContent.change(/</g,’<’)+’n<span class="’+(r[0]?’okay’:’no’)+’">’+(r[0]?’✓ ‘:’✗ ‘)+r[1].change(/</g,’<’)+'</span>’;
doc.getElementById(‘why’).textContent=r[2];busy=false;submit();
},650);
})});
// platforms
var P=[‘macOS uses the built-in sandbox-exec tool with Seatbelt profiles generated per run. The profile allows only 1 localhost port, where the srt proxies listen. Violations can be read from the system log in real time.’,
‘Linux uses bubblewrap and removes the network namespace entirely. Proxies are reached through Unix sockets bind-mounted into the sandbox. Ubuntu 24.04+ needs an AppArmor change for user namespaces.’,
‘Windows (alpha) runs commands as a dedicated srt-sandbox account. A machine-wide WFP filter blocks its outbound traffic except to the proxy ports. Setup needs 1 elevated install.’];
var pcs=R.querySelectorAll(‘.laptop’);
operate pd(i){pcs.forEach(operate(x){x.classList.take away(‘on’)});pcs[i].classList.add(‘on’);doc.getElementById(‘pdesc’).innerHTML='<h4>’+pcs[i].querySelector(‘h4’).textContent+'</h4>’+P[i];submit()}
pcs.forEach(operate(c,i){c.addEventListener(‘click on’,operate(){pd(i)})});pd(0);
operate bars(){R.querySelectorAll(‘.fg’).forEach(operate(f){f.fashion.width=”0″;setTimeout(operate(){f.fashion.width=f.getAttribute(‘data-w’)+’%’},80)})}
operate rows(){R.querySelectorAll(‘tr.row’).forEach(operate(r,i){r.classList.take away(‘in’);setTimeout(operate(){r.classList.add(‘in’)},90*i+60)})}
window.addEventListener(‘load’,submit);window.addEventListener(‘resize’,submit);setTimeout(submit,300);
})();
</script>
</physique>
</html>
“>

(operate(){var f=doc.getElementById(‘mtp-srt-frame’);window.addEventListener(‘message’,operate(e){if(e.supply===f.contentWindow&&e.knowledge&&e.knowledge.srtH){f.fashion.top=e.knowledge.srtH+’px’;}});})();

The actual trade-off: strict allowlists vs working brokers

Coding brokers do greater than edit information. They set up dependencies, pull docs and name APIs. Make the allowlist too strict and npm set up fails. Make it too free and the sandbox protects little. srt ships a number of knobs for that center floor:

Wildcards and ports: entries like *.npmjs.org or api.instance.com:443.
Ask callback: decides hosts no rule covers, and may return a motive the mannequin reads.
Per-command enable lists: open a registry for 1 invocation solely.
Reside updates: --control-fd swaps community lists whereas a command runs.
Resolved-address test: blocks allowed names that resolve to loopback or cloud metadata IPs.
Denied-domain causes: inform the agent the sanctioned various, reminiscent of an HTTPS git distant..

How does it evaluate with different agent sandboxes?

Function	Anthropic sandbox-runtime	OpenAI Codex CLI sandbox	Docker Sandboxes	E2B
Isolation	OS primitives: Seatbelt, bubblewrap, Home windows account + WFP	OS primitives: Seatbelt, bubblewrap, native Home windows sandbox	microVM per sandbox	Firecracker microVM per session
The place it runs	Native machine	Native machine	Native machine	Cloud or BYOC (AWS, GCP)
Container or VM wanted	No	No	Sure (microVM)	Sure (managed microVM)
Use outdoors its personal agent	Sure, CLI + library for any course of	Constructed into Codex	Sure, sbx CLI for coding brokers	Sure, JS and Python SDKs
Community default	Deny all; proxy allowlist	Off in `workspace-write`; config toggle	Coverage picked at first begin (e.g. deny-all, balanced)	On by default; will be disabled
Area allowlist	Sure, wildcards + ports	Not disclosed (on/off toggle documented)	Sure, wildcards + ports	Sure, `allowOut` with wildcards (SNI/Host based mostly)
License	Apache-2.0	Apache-2.0	Not disclosed	Apache-2.0 (SDK)
Standing	Beta analysis preview; Home windows alpha	Ships in Codex CLI	Transport product	Transport product

Key Takeaways

srt sandboxes any course of on the OS stage, no container wanted.
Seatbelt on macOS, bubblewrap on Linux, Home windows in alpha.
Community is deny-by-default; each connection passes a host-side allowlist proxy.
Anthropic stories 84% fewer Claude Code permission prompts (inside).
Allowlist breadth is the actual safety dial; broad domains can leak knowledge.

Try the GitHub repo, the Anthropic engineering post and the Claude Code sandboxing docs. All credit score goes to the researcher of this mission. Additionally, be happy to observe us on Twitter and don’t overlook to hitch our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.

Must companion with us for selling your GitHub Repo OR Hugging Face Web page OR Product Launch OR Webinar and so forth.? Connect with us

The submit Meet Anthropic’s sandbox-runtime: OS-Degree Sandboxing for AI Brokers, No Containers appeared first on MarkTechPost.

Meet Anthropic’s sandbox-runtime: OS-Degree Sandboxing for AI Brokers, No Containers

TL;DR

What’s Anthropic sandbox-runtime?

How does sandbox-runtime work on macOS, Linux and Home windows?

Why does it want each filesystem and community isolation?

How do you sandbox an MCP server or your individual agent?

What does the 84% determine imply?

The actual trade-off: strict allowlists vs working brokers

How does it evaluate with different agent sandboxes?

Key Takeaways

Bitcoin Core will disclose some bugs sooner. Can node operators replace in time?

Which AI prompts do you have to monitor? A sensible information

Converter

Editors Pick

Newsletter

Categories

Related Posts