Anthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool — and it works without containers. The tool wraps any process in filesystem and network restrictions, using each operating system’s own isolation features to keep AI agents, MCP servers and command-line tools in check.
Anthropic sandbox-runtime AI agent sandboxing is built on a simple idea: an agent that can read anything and reach anywhere is a security risk. By limiting which files a process can touch and which hosts it can reach, srt aims to stop prompt-injected agents from exfiltrating secrets like SSH keys.
Anthropic sandbox-runtime (Credits: MarkTechPost)
Anthropic Sandbox-Runtime: How It Works Without Containers
Unlike container-based sandboxes, srt uses native OS primitives. On macOS it relies on sandbox-exec with dynamically generated Seatbelt profiles, requiring only ripgrep. On Linux it uses bubblewrap with the network namespace removed, plus socat and ripgrep. Windows support is still in alpha, using a dedicated sandbox account, a Windows Filtering Platform egress fence and explicit file access rules.
Traffic leaves the sandbox only through HTTP and SOCKS5 proxies running on the host, which then apply the user’s domain allowlist and denylist. The npm package, @anthropic-ai/sandbox-runtime v0.0.81, is about 11.4 MB unpacked, licensed under Apache-2.0, and requires Node.js 22.12 or newer.
Installation is deliberately simple: install it globally with npm, then prefix any command with srt. It works as a command-line tool and as a TypeScript library, and it is not tied to Claude Code — your own agents, local MCP servers and plain CLI programs can all run inside it.
Anthropic Sandbox-Runtime Cuts Permission Prompts by 84%
The headline number comes from Anthropic’s own internal usage, where sandboxing cut Claude Code permission prompts by 84%. That figure is self-reported, not an external benchmark, but it points at a real problem: approval fatigue. Developers who click “approve” all day eventually stop reading what they are approving.
The defaults follow a strict logic. Reads are allowed everywhere unless denied, writes are denied everywhere unless allowed, and network access is denied unless a domain is allowlisted. Rules live in a settings file, so sandboxing an MCP server can be as simple as changing its command in .mcp.json from npx to srt and listing allowed domains such as api.github.com.
The trade-off is real, though. Make the allowlist too strict and everyday tasks like npm install fail; make it too loose and the sandbox protects little. Anthropic’s answer is a set of knobs for that middle ground — wildcards, ports and per-domain rules — aimed at letting agents work freely inside a fixed boundary and ask only at the edge.
Also Read: Anthropic IPO November Deadline Looms: Will the Claude Maker File Its S-1 in Time?
Source: MarkTechPost — read the full story there.
