{
  "checklist_items": [
    {
      "id": "chk_sandbox_84_percent",
      "item": "Sandboxing reduces permission prompts by 84% in Anthropic's own internal usage.",
      "category": "sandboxing",
      "source_title": "Making Claude Code more secure and autonomous with sandboxing",
      "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
      "summary": "The measured impact of the sandbox boundary model: an 84% reduction in permission prompts.",
      "created_at": "2026-07-02 06:02:48",
      "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_84_percent"
    },
    {
      "id": "chk_sandbox_notify_on_escape",
      "item": "If Claude tries to access something outside the sandbox boundary, the user is notified immediately and can choose whether to allow it -- the boundary lets Claude act freely inside it while still surfacing any attempted escape.",
      "category": "sandboxing",
      "source_title": "Making Claude Code more secure and autonomous with sandboxing",
      "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
      "summary": "Escape attempts are surfaced immediately for a human decision, rather than either silently blocked or silently allowed.",
      "created_at": "2026-07-02 06:02:48",
      "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_notify_on_escape"
    },
    {
      "id": "chk_sandbox_os_primitives",
      "item": "The sandbox is built on OS-level security primitives -- Linux bubblewrap and macOS Seatbelt -- to enforce filesystem and network restrictions at the OS level, not just in the application layer.",
      "category": "sandboxing",
      "source_title": "Making Claude Code more secure and autonomous with sandboxing",
      "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
      "summary": "Enforcement happens at the OS level (bubblewrap on Linux, Seatbelt on macOS), which is stronger than an app-level permission check alone.",
      "created_at": "2026-07-02 06:02:48",
      "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_os_primitives"
    },
    {
      "id": "chk_sandbox_prompt_injection_defense",
      "item": "Filesystem isolation is particularly important in preventing a prompt-injected Claude from modifying sensitive system files; network isolation prevents a prompt-injected Claude from leaking sensitive information or downloading malware.",
      "category": "sandboxing",
      "source_title": "Making Claude Code more secure and autonomous with sandboxing",
      "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
      "summary": "The two boundaries exist specifically as a defense against prompt-injection attacks attempting to escape the working directory or exfiltrate data.",
      "created_at": "2026-07-02 06:02:48",
      "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_prompt_injection_defense"
    },
    {
      "id": "chk_sandbox_two_boundaries",
      "item": "Anthropic's Claude Code sandboxing draws two boundaries -- filesystem isolation (read/write confined to the working directory) and network isolation (an allowlist of domains via a proxy) -- so Claude can act freely inside the boundary without asking permission for every step, and is flagged immediately if it tries to leave it.",
      "category": "sandboxing",
      "source_title": "Making Claude Code more secure and autonomous with sandboxing",
      "source_url": "https://www.anthropic.com/engineering/claude-code-sandboxing",
      "summary": "The core two-boundary model: filesystem confinement to the working directory, and network confinement to an allowlist via a proxy.",
      "created_at": "2026-07-02 06:02:48",
      "cite_as": "https://subagentchecklists.com/api/checklist-items/chk_sandbox_two_boundaries"
    }
  ]
}