Anthropic open sources OS-level sandbox for AI agents

A new layer of security

Anthropic recently open-sourced a tool called sandbox-runtime (srt). This software acts as a security wrapper that limits what files a process can touch and which network hosts it can reach. It is designed to provide a secure environment for AI agents and local tools to execute commands without granting them full access to a user's machine.

While many developers use containers like Docker to isolate applications, this tool works differently. It uses OS-level isolation primitives to create a sandbox. This means it does not need to spin up a virtual machine or a container, making it a lighter weight solution for running local commands.

The tool is not strictly tied to Claude Code, though it serves as the engine behind its sandboxed bash tool. Developers can use it to run their own agents, local Model Context Protocol (MCP) servers, or standard command-line programs within a restricted environment.

How the sandbox operates

The sandbox-runtime functions by wrapping a command with the 'srt' prefix. It then applies restrictions based on a configuration file. For example, a user can specify which domains are allowed for network traffic and which directories should be blocked from reading or writing.

The technical implementation varies depending on the operating system. On macOS, it uses sandbox-exec with dynamically generated Seatbelt profiles. On Linux, it utilizes bubblewrap and removes the network namespace to ensure the process cannot reach the internet directly.

For Windows, the tool is currently in an alpha state. It uses a dedicated sandbox account, a Windows Filtering Platform egress fence, and explicit file Access Control Lists (ACLs). In all cases, traffic is routed through proxies on the host that apply the user's specific allowlists and denylists.

Solving approval fatigue

One of the primary goals of this tool is to reduce 'approval fatigue' for developers. When an AI agent has too much freedom, it must constantly ask the user for permission to perform actions. This leads to users clicking 'approve' reflexively without actually checking what the agent is doing.

Anthropic reported that using this sandbox reduced permission prompts by 84% in internal usage. By establishing a fixed boundary, the agent can work freely inside the allowed zone. It only needs to ask for permission when it attempts to cross the edge of the defined sandbox.

The tool follows a logic where reads are allowed everywhere unless denied, while writes are denied everywhere unless allowed. Network access is also denied by default unless a domain is explicitly added to an allowlist. This ensures that a prompt-injected agent cannot easily exfiltrate sensitive data like SSH keys.

Flexibility for developers

The sandbox-runtime includes several features to balance security with usability. Developers can use wildcards and ports to allow specific services, such as allowing all traffic to a specific API domain. It also supports an 'ask' callback for hosts that do not have a pre-defined rule.

For more complex workflows, the tool offers per-command allowlists. This allows a developer to open a registry for a single invocation only, rather than leaving it open permanently. There is also a control file option that allows for live updates to the network settings during a process's execution.

The tool is distributed as an npm package and requires Node.js version 22.12 or higher. It is licensed under Apache-2.0, making it accessible for both personal projects and commercial applications. It is designed to run on macOS, Linux, and currently in alpha on Windows.

Implementation and next steps

Integrating the sandbox into existing workflows is straightforward for those using MCP servers. Users can modify their configuration files to prefix their commands with 'srt' and pass the original command as an argument. This automatically applies the rules defined in a local settings file.

For those building custom agents, Anthropic provides a TypeScript library. This library includes a SandboxManager that can initialize proxies and wrap commands. This allows for programmatic control over how the sandbox behaves during an agent's lifecycle.

Moving forward, the project is still considered a beta research preview. While it provides a robust foundation for local AI safety, the Windows support is still in its early stages. Developers interested in testing it can install the package globally via npm to begin experimenting with OS-level restrictions.

Try it today

If you use MCP servers or local AI agents, you can check your current configuration files to see if you are running commands with full system access. You can try installing the sandbox-runtime via npm to see how it restricts a simple command like 'cat' on a protected directory like ~/.ssh.

Anthropic's sandbox-runtime