Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers
In this article, we will discuss newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool. The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code. Your own agents, local MCP servers and plain command-line programs can run inside it.
What is Anthropic sandbox-runtime?
Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It works as a CLI and as a TypeScript library.
How does sandbox-runtime work on macOS, Linux and Windows?
srt uses each operating system’s own isolation primitives. Its restrictions cover the entire process tree, including scripts and subprocesses.
macOS: sandbox-exec with dynamically generated Seatbelt profiles. Only ripgrep is required.
Linux: bubblewrap with the network namespace removed. It also needs socat and ripgrep.
Windows (alpha): a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs.
Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux, those proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile allows only one localhost port. The proxies then apply your domain allowlist and denylist.
Why does it need both filesystem and network isolation?
Anthropic team argues that 1 boundary without the other fails. Without network isolation, a prompt-injected agent could exfiltrate SSH keys. Without filesystem isolation, it could escape the sandbox and gain network access.
srt’s defaults follow that logic. Reads are allowed everywhere unless denied. Writes are denied everywhere unless allowed. Network access is denied unless a domain is allowlisted.
How do you sandbox an MCP server or your own agent?
For an MCP server, change the command in .mcp.json from npx to srt. Pass the original command as arguments. Rules then live in ~/.srt-settings.json:
“network”: { “allowedDomains”: [“api.github.com”, “*.npmjs.org”], “deniedDomains”: [] },
“filesystem”: { “denyRead”: [“~/.ssh”], “allowWrite”: [“.”], “denyWrite”: [“.env”] }
}
For your own agent, the library exposes SandboxManager. Call initialize(config) to start the proxies. Then wrapWithSandbox() returns a wrapped command string you can spawn.
What does the 84% figure mean?
Anthropic reports that sandboxing reduced permission prompts by 84% in internal Claude Code usage. That is a self-reported number, not an external benchmark. The target is approval fatigue. Developers who click “approve” all day stop reading what they approve. A fixed boundary lets the agent work freely inside it and ask only at the edge.
The real trade-off: strict allowlists vs working agents
Coding agents do more than edit files. They install dependencies, pull docs and call APIs. Make the allowlist too strict and npm install fails. Make it too loose and the sandbox protects little. srt ships several knobs for that middle ground:
Wildcards and ports: entries like *.npmjs.org or api.example.com:443.
Ask callback: decides hosts no rule covers, and can return a reason the model reads.
Per-command allow lists: open a registry for 1 invocation only.
Live updates: –control-fd swaps network lists while a command runs.
Resolved-address check: blocks allowed names that resolve to loopback or cloud metadata IPs.
Denied-domain reasons: tell the agent the sanctioned alternative, such as an HTTPS git remote..
How does it compare with other agent sandboxes?
Check out the GitHub repo, the Anthropic engineering post and the Claude Code sandboxing docs. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Asif Razzaq is the CEO of Marktechpost AI Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.
Originally published by marktechpost.com →
