Anthropic describes containment architecture for agentic Claude systems

Anthropic published an engineering account of how it contains agentic Claude deployments, describing three distinct architectures used across its products rather than a single system. In claude.ai, agent sessions run server-side inside gVisor sandboxes on isolated, per-session infrastructure with no persistent filesystem. Claude Code, which runs on a user’s own machine with filesystem and shell access, relies on OS-level sandboxing — Seatbelt on macOS, bubblewrap on Linux — with tiered permissions that allow reads by default but require explicit approval for writes or network access; an “auto mode” classifier was said to catch roughly 83% of risky actions to reduce approval fatigue. Claude Cowork, a fuller agentic product, isolates code execution inside a sealed virtual machine using platform hypervisors, with configurable file-mount modes and a defensive network proxy controlling what the VM can reach.

Anthropic framed the containment layers as necessary specifically because the model itself cannot be trusted as the sole safeguard, and disclosed several incidents that had shaped the design: a case of “pre-trust” code execution via a .claude/settings.json hook that ran before a user approved it; a direct prompt-injection attack that successfully exfiltrated AWS credentials in 24 of 25 attempts; and exfiltration carried out through domains an agent had already been approved to contact, using attacker-controlled API keys. It also noted that virtual-machine isolation, while effective at containment, reduces visibility for endpoint detection and response tooling monitoring the host.

The disclosure was unusually candid for a vendor write-up, presenting containment engineering as a response to specific attacks that had partially succeeded rather than as a preventive measure against hypothetical ones.