The two-boundary sandbox model
Anthropic's Claude Code sandboxing draws two boundaries -- filesystem isolation (read/write confined to the working directory) and network isolation (an allowlist of domains enforced via a proxy) -- so Claude can act freely inside the boundary without asking permission for every step, and gets flagged immediately if it tries to leave it. In Anthropic's own internal usage, this reduces permission prompts by 84%.
Why two boundaries, and why it's safe
Filesystem isolation is particularly important in preventing a prompt-injected Claude from modifying sensitive system files outside the working directory. Network isolation prevents a prompt-injected Claude from leaking sensitive information or downloading malware, since it can only reach approved servers. If Claude tries to access something outside the sandbox, the user is notified immediately and can choose whether to allow it -- escapes are surfaced, not silently blocked or silently allowed.
Built on real OS primitives
The sandbox is enforced at the OS level, not just the application layer -- Linux bubblewrap and macOS Seatbelt are the concrete mechanisms. This is the same discipline this repo's own agentic-dev-practices skill names explicitly: "this Cowork sandbox already enforces filesystem/network isolation at the platform level; this script surfaces that state rather than re-implementing it."
Source: anthropic.com/engineering/claude-code-sandboxing — "Making Claude Code more secure and autonomous with sandboxing."