Anthropic introduces os-level sandboxing tool for AI agents

Anthropic has unveiled sandbox-runtime, an open-source tool that provides OS-level sandboxing for AI agents without requiring containers. The tool, designed to work with Claude Code’s sandboxed bash tool, restricts file access and network connections for processes while avoiding containerization. It is not limited to Claude Code and can be used with local MCP servers and command-line programs. The tool wraps any process in filesystem and network restrictions, functioning as both a CLI and a TypeScript library. It leverages each operating system’s isolation primitives, applying restrictions to the entire process tree, including scripts and subprocesses. Traffic is routed through HTTP and SOCKS5 proxies on the host, with domain allowlists and denylists enforced. Anthropic claims sandboxing reduced permission prompts by 84% in internal usage, aiming to mitigate approval fatigue. The tool offers several configuration options to balance security and functionality, allowing for flexible allowlists and restrictions. Developers can integrate sandbox-runtime via npm or through the provided library, with settings managed in a configuration file.