{
  "checklist_item": {
    "id": "chk_sandbox_prompt_injection_defense",
    "item": "Filesystem isolation is particularly important in preventing a prompt-injected Claude from modifying sensitive system files; network isolation prevents a prompt-injected Claude from leaking sensitive information or downloading malware.",
    "category": "sandboxing",
    "source_title": "Making Claude Code more secure and autonomous with sandboxing",
    "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
    "summary": "The two boundaries exist specifically as a defense against prompt-injection attacks attempting to escape the working directory or exfiltrate data.",
    "created_at": "2026-07-02 06:02:48",
    "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_prompt_injection_defense"
  }
}