How we contain Claude across products

Max McGuinness and colleagues on why containment has to be environmental rather than behavioural: rather than supervising what the agent does, we supervise what it’s able to do by enforcing access boundaries. Model-layer defences are probabilistic and will eventually fail, so the hard boundary has to sit underneath them. Their rule for which boundary to trust:

The weakest layer is the one you built yourself. gVisor and seccomp have been hardened against well-resourced adversaries for far longer than agentic AI has existed.

Three concrete patterns, not one generic sandbox. claude.ai uses ephemeral containers on gVisor with seccomp syscall filtering and a per-session filesystem. Claude Code uses an OS-level sandbox, Seatbelt on macOS and bubblewrap on Linux, where reads are allowed, writes are confined to the workspace and network is denied by default; that cut permission prompts by 84%, and the runtime is open source so the boundary is auditable. Claude Cowork goes furthest, running a full VM on the platform hypervisor with a vsock boundary, three mount modes, and the agent loop running outside the VM while code executes inside.

The failure cases are the useful part. An egress allowlist that permitted api.anthropic.com was turned against them: a malicious file used an attacker-controlled API key to upload workspace files into the attacker’s own account, because an allowlist treats a domain as a destination when it is really a capability grant. Every function reachable through any domain on an allowlist is now an attack surface. The fix was a proxy inside the VM that accepts only the VM’s provisioned session token. A separate phishing exercise got Claude to exfiltrate AWS credentials 24 times out of 25 retries, which is the number that makes the case for egress controls better than any argument does.

Two things worth keeping. Permission prompts decay: users approved about 93% of them, so a prompt stream is not really a control. And the honest admission at the end, that twelve months ago, we’d have rejected out of hand the idea of granting Claude access sufficient to take down an internal Anthropic service. Compare Constrain the agent, not the user, which reaches the same conclusion from the productivity side.