Anthropic has described how it contains Claude across web, coding, and desktop products, arguing that agent safety needs hard environmental limits as well as model-level safeguards. The company’s central point is that prompts, classifiers, and training can influence behavior, but they do not guarantee what an agent can access or send.
InfoQ reports that code execution on claude.ai runs in ephemeral gVisor containers on isolated infrastructure without access to a user’s local filesystem. Claude Code is different because it works on a developer’s machine. Anthropic says it initially relied heavily on per-action approvals, but users approved about 93 percent of prompts, weakening the protection those dialogs provided.
The company later added OS-level sandboxing, using Seatbelt on macOS and bubblewrap on Linux, with workspace writes allowed and network access denied by default. Anthropic says that change reduced permission prompts by 84 percent.
The lesson is important for agent builders. If an AI system can read files, run commands, or reach the network, safety has to be designed into the execution environment. User approval remains useful, but it is too fragile to be the only barrier.