Anthropic sandbox-runtime: OS-level agent security

What changed

Anthropic has open-sourced sandbox-runtime (srt), an OS-level sandboxing tool for restricting file and network access to any process without requiring containers. The tool emerged from work on Claude Code’s sandboxed bash feature and is now available as a research preview for developers building agents, local MCP servers, and command-line programs. Installation happens via npm, and you prefix any command with srt to apply restrictions. The package is version 0.0.81, approximately 11.4 MB unpacked, and runs on macOS and Linux, with Windows support available in alpha.

The implementation uses native OS sandboxing primitives on each platform. On macOS, srt generates dynamic Seatbelt profiles and uses sandbox-exec for isolation. On Linux, it leverages bubblewrap with network namespace removal, along with socat and ripgrep. On Windows, the tool runs the process under a dedicated srt-sandbox user account with Windows Filtering Platform rules for egress filtering and explicit file access control lists. All network traffic routes through host-based proxy servers that check against your configured allowlist before permitting outbound connections.

Anthropic reports that sandboxing reduced permission prompts in Claude Code by 84% compared to environments without these boundaries. This figure represents internal usage data rather than an external benchmark. The reasoning behind this reduction centers on approval fatigue: developers who face frequent prompts may stop carefully reviewing approval requests. A fixed sandbox boundary allows agents to operate freely within defined limits and only request permission at the perimeter, reducing the total number of decisions required from developers.

Why it matters

AI agents capable of reading files, installing packages, and making network calls present legitimate security concerns in production environments. A prompt-injected agent with unrestricted network access could transmit SSH keys or credentials to external servers. An agent with unrestricted filesystem access could read or modify sensitive configuration files. Anthropic argues that both barriers must exist simultaneously, or attackers can exploit whichever boundary remains undefended.

This release addresses a practical gap in agent security tooling. Containers and microVMs provide strong isolation but introduce operational overhead and deployment complexity. OS-level sandboxing offers lighter-weight restrictions that integrate with existing development workflows without requiring containerization, image building, or separate deployment infrastructure. Developers using Node.js 22.12 or later can adopt srt immediately by modifying command references in configuration files like .mcp.json and defining allowlists in a JSON settings file.

For teams developing agents, this approach shifts security strategy from reactive auditing to proactive boundary definition. Rather than investigating whether an agent accessed restricted resources after execution, sandboxing prevents such access from occurring in the first place. The practical challenge involves configuring allowlists precisely enough to block harmful access while remaining broad enough for agents to complete their intended work. The tool offers several configuration knobs to navigate this balance: wildcard domain patterns, per-command allowlists, domain-specific reasons for denials that agents can read, resolved-address checks that block loopback and cloud metadata IPs, and live network rule updates while processes run.

What to test

Before deploying srt in production environments, validate these specific capabilities and limitations:

• Permission prompt reduction: Anthropic’s 84% reduction reflects internal Claude Code patterns. Test whether your agent workloads see comparable decreases. The actual benefit depends directly on allowlist configuration breadth; loose allowlists may show minimal improvement.

• Allowlist configuration precision: Verify that your domain allowlist configuration blocks exfiltration attempts while permitting legitimate operations. Test typical agent activities including npm package installation, git repository cloning, and API calls your agent requires. Broad entries like *.npmjs.org offer convenience but expand the attack surface significantly.

• Windows alpha status: macOS and Linux sandboxing is documented and relatively mature. Windows support remains in alpha and may contain edge cases or incomplete functionality. Thoroughly test Windows deployments before using srt in production on that platform.

• Process tree coverage: Confirm that restrictions apply to child processes and subprocesses spawned by your agent, not solely the parent process. Anthropic states srt covers entire process trees, but verify behavior with your specific agent implementation and toolchain.

• Metadata IP blocking: Test the resolved-address check feature that blocks domains resolving to loopback addresses and cloud metadata IPs, which can prevent credential exfiltration attacks. Ensure this feature works correctly with your network environment without blocking legitimate traffic.

• Proxy latency: Network requests route through host-side proxy servers that validate allowlists. Measure latency overhead on your typical agent workloads. High-frequency network operations or patterns with numerous I/O operations may experience noticeable delay from the proxy hop.

• Configuration updates: Test live allowlist updates via the --control-fd flag while agents execute. Verify that rule changes take effect correctly and consistently during long-running operations.

Common questions

How does srt differ from running agents in a container?

Docker containers and similar technologies provide strong isolation but require building container images, managing layers, and deploying separate runtime environments. srt applies OS-level restrictions directly to processes without these setup steps. It integrates seamlessly into existing CLI workflows and development practices. The tradeoff involves relying on platform-specific OS primitives (Seatbelt, bubblewrap, Windows Filtering Platform) that behave differently across operating systems, whereas containers present more uniform behavior across systems.

Can an agent escape srt restrictions?

Anthropic designed srt with both filesystem and network isolation specifically to prevent escape attempts. A process with unrestricted network but restricted files could contact a remote attacker-controlled server to receive instructions for local exfiltration. A process with unrestricted files but restricted network could directly access sensitive files. srt enforces both restrictions together to close these avenues. As a research preview, edge cases may exist, particularly on Windows where support remains alpha. No sandbox provides absolute guarantees against all attack vectors.

What is the ask callback?

The ask callback is a configuration option that determines srt’s behavior when a process attempts to access a network host or socket not covered by any existing rule. Instead of automatically blocking the request, the ask callback can return a decision (allow or deny) along with a reason. The agent receives this reason and can adapt its behavior accordingly. This approach adds flexibility for agents that must handle unexpected network scenarios gracefully while maintaining security boundaries.

The conclusion

Anthropic sandbox-runtime addresses a concrete challenge: enabling safe agent execution without container overhead. The dual-isolation model combining filesystem and network restrictions is architecturally sound, and the OS-level implementation proves practical for developers already working with Node.js and bash-based workflows. The 84% permission prompt reduction represents meaningful data, though it reflects internal usage patterns and results may vary depending on your specific agent implementations and allowlist configurations.

The tool remains in research preview status, meaning APIs and configuration formats may evolve. Windows support is early and requires careful testing. If you are developing agents or local MCP servers and want lightweight OS-level restrictions without container complexity, sandbox-runtime merits evaluation in your development environment. In production, treat this tool as a security layer alongside complementary practices: code review, runtime monitoring, and application of least-privilege principles. Monitor the GitHub repository for updates as the project matures.

Related reading

• Perplexity SPACE: Sandbox platform for AI agents
• Google Agent Compute Engine: microVM isolation, zero credentials
• Grok Voice 3.0 vs Voxtral 3: Voice Agent Comparison