Anthropic has open-sourced the sandbox that powers Claude Code, giving developers a lightweight way to fence in AI agents without spinning up containers. The tool, called sandbox-runtime (srt), wraps any process in operating-system-level filesystem and network restrictions.
The idea is simple: an agent that can read files, run code, and call APIs needs boundaries it cannot talk its way past. Instead of a full container, srt uses the host operating system’s own isolation tools. On macOS it uses sandbox-exec with Seatbelt profiles; on Linux it uses bubblewrap, plus socat and ripgrep; Windows support is still in alpha.
By default, the network is deny-all. Traffic only leaves through host-side proxies to domains on an allowlist, so a compromised or tricked agent cannot quietly send data to an unfamiliar server. Reads are generally allowed unless denied, while writes are denied unless explicitly allowed — a setup designed to stop both data theft and accidental damage.
Developers install it from npm as @anthropic-ai/sandbox-runtime and prefix a command with srt. It works as a command-line tool and a TypeScript library, and it is not limited to Claude Code: local MCP servers and ordinary command-line programs can run inside it too. Anthropic says sandboxing cut permission prompts by 84% in its internal Claude Code use, though that figure is self-reported, not an independent benchmark.
For teams building agents on Claude, Cursor, or GitHub Copilot, srt is worth a look: it turns agent safety from a pile of approval clicks into a fixed boundary the agent works inside.
Source: MarkTechPost
