Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers

Why it matters

Anthropic has released sandbox-runtime, the operating-system-level sandboxing tool that powers Claude Code's sandboxed bash feature, as an open-source Apache-2.0 npm package. Rather than relying on containers, it constrains what files a process tree can read or write and which network hosts it can reach, using native isolation mechanisms: Seatbelt profiles on macOS and bubblewrap on Linux, with Windows support still in an early alpha state. Network access is denied by default, with traffic routed through host-side proxies that enforce domain allowlists and denylists. Anthropic says that internally this approach sharply reduced the permission prompts Claude Code generates, easing the approval fatigue that leads developers to stop scrutinizing what they authorize. The tool is not tied to Claude Code; it can wrap any agent, local MCP server, or command-line program, and is usable both as a CLI and as a TypeScript library. The central tension the piece highlights is configuration: overly strict allowlists break legitimate agent work like dependency installation, while overly broad ones weaken the protection the sandbox exists to provide.