Anthropic Adds OS-Level Sandbox to Claude Code, but Key Gaps Remain

Anthropic has introduced OS-level sandboxing for Claude Code, using macOS Seatbelt and Linux bubblewrap to constrain what Bash commands and their child processes can access. Write access is restricted by default to the current working directory and session temp, but read access spans nearly the entire filesystem, leaving sensitive files like ~/.aws/credentials and ~/.ssh exposed unless manually configured. The sandbox fails open by default, meaning it silently disables itself if unavailable, and does not run at all on native Windows. Anthropic's own documentation acknowledges that the feature reduces risk but does not constitute a complete isolation boundary, with explicit warnings about TLS inspection gaps and Docker socket exposure. Security analysts note that sandboxing addresses containment but does not resolve consequence or recovery — scenarios where a syntactically correct command causes unintended large-scale damage remain outside its scope.