The AI company has published comprehensive documentation of its containment strategies for Claude.ai, Claude Code, and Cowork products.
- Anthropic has released detailed documentation of how it sandboxes Claude across different products using various containment technologies
- Claude.ai uses gVisor, Claude Code uses Seatbelt (macOS) and Bubblewrap (Linux), while Claude Cowork runs full VMs
- The company acknowledges past security oversights, including an API exfiltration vector it previously missed
- Anthropic’s open source Sandbox Runtime Tool (srt) is now considered mature enough for broader evaluation
Layered Containment Strategy
Anthropic has published comprehensive documentation detailing how it contains Claude across its product portfolio. The company employs multiple containment layers including process sandboxes, virtual machines, filesystem boundaries, and egress controls. The stated goal is establishing hard boundaries around what Claude agents can access, ensuring that sensitive data like credentials never enter sandboxed environments where they could be compromised.
Product-Specific Implementations
Each Claude product uses different sandboxing technologies tailored to its deployment model. Claude.ai relies on gVisor for containment. Claude Code, which runs locally on user systems, uses Seatbelt on macOS and Bubblewrap on Linux. Claude Cowork takes the most robust approach, running full virtual machines through Apple’s Virtualization framework on macOS and HCS on Windows.
Learning from Past Oversights
The documentation acknowledges security risks the company previously missed. Anthropic specifically references an exfiltration vector involving api.anthropic.com/v1/files that it had not initially recognised. This transparency about past security gaps suggests the company is taking a more systematic approach to identifying and documenting potential attack vectors.
Open Source Tools Available
Anthropic has made its Sandbox Runtime Tool (srt) available as open source software. The tool is now considered mature enough for broader evaluation and use. This move toward open source sandboxing tools could provide security teams with additional options for containing AI workloads, though the specific capabilities and limitations of srt are not detailed in the available documentation.
Why it matters
For CISOs evaluating AI deployments, this documentation provides rare insight into how a major AI provider actually implements containment. Most sandboxing products lack thorough documentation, making it difficult to assess their trustworthiness. Understanding Anthropic’s multi-layered approach and their acknowledgment of past oversights offers a framework for evaluating both internal AI security controls and vendor claims about AI safety measures.
What to do now
- Review Anthropic’s published sandboxing documentation to understand containment approaches for AI workloads
- Evaluate whether your organisation’s AI deployments have similar multi-layered containment strategies
- Consider examining Anthropic’s open source Sandbox Runtime Tool for potential use in your environment
- Assess whether your AI vendors provide similarly detailed documentation about their security controls
