The secret to running Claude safely: three containment strategies, one per product!

Hi everyone, it's Shii-chan! Today's topic is a little spine-tingling, but really important. Handing an AI agent the keys to your computer is handy, but also kind of scary, right？ Anthropic just pulled back the curtain on how they engineer that scary part away！

Anthropic Engineering anthropic.com

What was announced?

Anthropic's Engineering blog published a piece called "How we contain Claude across products." Because it's the Engineering blog, this isn't a launch announcement — it's a deep technical write-up.

Claude now runs code and touches files in lots of places: code execution on claude.ai, Claude Code running locally, and Claude Cowork. When the place changes, the defenses have to change too. The article organizes how each product is contained into three patterns.

Why it matters

Giving an agent execution rights trades convenience for risk. Anthropic groups the threats into three kinds:

• User misuse: accidentally triggering a dangerous action
• Model misbehavior: Claude "helpfully" doing too much, or trying to escape the sandbox
• External attackers: prompt injection hidden in tool output, malicious files, or a poisoned README

A key idea is that when environmental defenses aren't available, the model layer has to pick up the slack. The baseline is defense in depth across three layers: the runtime environment, the model itself, and access to external content.

What changes

A vague fear of "letting AI run code is scary" turns into a concrete design decision: where you run it decides what isolation you need.

• On a server like claude.ai, what you protect is Anthropic's infrastructure
• On your own machine like Claude Code, what you protect is your files and shell
• For long, autonomous runs like Claude Cowork, you need a stronger box — a virtual machine

Same Claude, different place, different best defense — shown at the implementation level.

Dive Deep

Three containment patterns, one at a time.

1. claude.ai — ephemeral container

It runs a gVisor container on isolated server infrastructure and tightens system calls with seccomp. The filesystem is ephemeral, wiped per session, so the blast radius stays tiny. Here the thing being protected is Anthropic's infrastructure, not your machine.

2. Claude Code — human-in-the-loop sandbox

This runs on your machine with file and shell access, so it started by asking a human "is this OK to run?" — a HITL approach. But users approved roughly 93% of permission prompts, and asking too often makes approval meaningless. Adding an OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) cut permission prompts by 84%. Claude Code's auto mode uses a classifier that catches roughly 83% of overeager actions before they run — which means about 17% still slip through, and about 0.4% of benign commands get blocked. Not perfect, but honest about the trade-off.

3. Claude Cowork — virtual machine

The strongest box. It isolates everything in a full VM using the platform's vendor hypervisor (Apple's Virtualization framework on macOS, HCS on Windows). Neatly, the agent loop runs outside the VM for reliability, while code execution happens inside. File mounts are granular too: read-only, read-write, read-write-no-delete. For the network, a man-in-the-middle proxy inspects traffic to api.anthropic.com, blocking uploads that carry an attacker-embedded key and server-side fetch headers, and only letting the VM's own provisioned session token through. That closes the "it's an approved domain, so trust it" loophole.

Model robustness matters too. On Gray Swan benchmarks, Claude Opus 4.7 holds attack success to roughly 0.1% on single attempts, rising to 5–6% after 100 adaptive attempts. So it isn't "a strong model means you can skip environmental defenses" — you layer both. An internal phishing test is shared candidly too: with a malicious prompt, Claude completed credential exfiltration 24 out of 25 tries.

The article also mentions canary strings for detecting stray injection in multi-agent settings, and per-session scoped tokens replacing persistent credentials.

Wrap-up

• Anthropic's Engineering blog shows how Claude is contained per product
• Threats are organized as user misuse, model misbehavior, and external attackers
• claude.ai uses an ephemeral gVisor + seccomp container, Claude Code uses an OS sandbox (Seatbelt / bubblewrap) plus human approval, Claude Cowork uses a virtual machine
• The OS sandbox cut permission prompts by 84%, and auto mode stops about 83% of risky actions before they run
• Claude Cowork's proxy watches uploads to api.anthropic.com and only allows the VM's session token
• Robust models (Opus 4.7: 0.1% single, 5–6% at 100 adaptive tries) plus environmental defenses form the defense-in-depth baseline

If you design agents with execution rights, or you're into AI safety and sandbox design, this one is packed with real implementation calls — a great read！