Evidence at a glance
The mechanism in one line
Compress the visual or contextual input before the main reasoning path.
Route or verify the expensive step instead of repeating the full path.
Translate the mechanism into a bounded deployment or evaluation check.
It Does Not Sandbox All of Claude Code
Anthropic’s open-source sandbox-runtime, or srt, is a tool for restricting the filesystem and network access of commands, MCP servers, and other processes. Anthropic says Claude Code uses it to sandbox the Bash tool; that does not mean all of Claude Code runs inside srt’s boundary. The runtime can also be used independently with custom agents or ordinary command-line programs.
That distinction matters because the phrase “the agent is sandboxed” can suggest that the model, its tools, and the host environment all share one protective layer. In practice, srt constrains the process it launches and its child processes. It provides an operating-system-level boundary, not a complete security design for the surrounding application.
Security Moves from Repeated Prompts to Defined Boundaries
Claude Code’s earlier control model asked users to approve certain actions, such as modifying files, running commands, or accessing the network. Per-action approval seems to keep a person in the loop, but frequent prompts can create approval fatigue: once users get used to clicking through them, a prompt no longer reliably signals careful review. srt changes the cadence by letting a process work within a predefined permission boundary and addressing only attempts to cross it.
The policy has two parts. According to the project README, file reads are allowed by default and can be denied by rule; writes are denied unless specific paths are opened; and network access is denied unless traffic matches an allowed-domain rule. Anthropic’s rationale is that the two forms of isolation are not interchangeable. Network restrictions alone may still leave sensitive files readable, while filesystem restrictions alone do not prevent a process from causing harm over the network.
One Policy, Different Operating-System Primitives
srt does not require separately managing Docker images or a container orchestration system, but that does not mean it avoids every container-like isolation mechanism. On macOS it uses the system’s sandbox-exec interface and dynamically generated Seatbelt rules. On Linux it uses bubblewrap, bind mounts, and network namespace isolation. In both cases, the restrictions apply to the launched command and its child processes, not just to the first command issued by an agent.
Network traffic also passes through a proxy on the host, where domain allow and deny rules are applied. Linux connects to the proxy through a Unix socket bind-mounted into the sandbox; on macOS, the Seatbelt profile permits access to a specified local port. Windows is listed as supported, but remains alpha and uses a dedicated account, file ACLs, and Windows Filtering Platform egress restrictions. For operators, “cross-platform” therefore does not mean equal maturity or identical operational requirements on all three systems.
The 84% Figure Counts Fewer Prompts, Not Less Risk
Anthropic reports that sandboxing reduced permission prompts by 84% in its internal Claude Code usage. That figure suggests fixed boundaries can reduce the number of approvals users must handle, but it is an internally reported result, not an independent external benchmark. The available material does not establish a corresponding reduction in security risk.
A more cautious reading is that srt aims to spare users repeated decisions and reserve their attention for actions that cross a boundary. Fewer prompts do not prove lower risk, particularly if allowed paths or domains are too broad. Teams can treat the figure as evidence of a workflow change, but not as a substitute for evaluating policy quality or the relevant threat model.
Review the Rules Before Increasing Autonomy
srt can be used as a command-line prefix and also exposes a TypeScript library interface. An MCP server’s launch command can likewise be wrapped by srt. The configuration supports explicit network allowlists and filesystem rules, giving teams a way to put isolation policy into routine development setup rather than leaving it inside an agent product.
However, placing a process in a sandbox does not decide which files it should read, which directories it may write, or which domains deserve access. Linux also requires bubblewrap, socat, and ripgrep; macOS requires ripgrep; Windows remains alpha; and the project material describes srt as a beta research preview. In practice, start with the narrowest useful write paths and network allowlist, then verify what scripts and child processes actually need. Fewer approval prompts are acceptable automation only when the team can keep those boundaries reviewed and maintained. Otherwise, risk has merely moved from a prompt window into a configuration file.