A strict sandbox mode surfaces in Claude Code desktop

Anthropic is preparing an option for Claude Code desktop that runs commands from the assistant inside an isolated sandbox on the local machine, a setting that takes effect for new sessions. The wording comes from interface text in the desktop application, published on Threads, and has not been announced.

At a glance

• The setting describes an isolated environment for shell commands issued by Claude Code, applied to sessions started after it is switched on rather than to ones already running.
• A strict variant blocks commands that cannot run inside the sandbox, ssh among them, instead of falling back to running them outside the sandbox or prompting for a decision.
• Strict mode covers every Claude Code session on the machine, terminal sessions included, and only a project's own settings can override that computer-wide default for a given repository.

Permission prompts are the main friction in agentic coding: every shell command that touches the filesystem or the network can stop the run and wait for approval. Defining those boundaries in advance reads as an attempt to move the trust decision from the individual command up to the session, and the strict variant looks aimed at machines where quietly falling back to an unsandboxed run is not acceptable.

The strict variant changes what happens to commands the sandbox cannot accommodate. Rather than running them outside the sandbox or asking for a decision, it blocks them, with ssh given as the example in the settings text, which appears alongside the base sandbox toggle.

The two settings differ in reach. The base sandbox is tied to new sessions, while the strict option is defined at the level of the computer rather than a single client, and the settings text names one exception to that.

Applies to every Claude Code session on this computer, including the terminal, unless a project’s own settings override it.

Anthropic's documentation covers the same mechanism on the command line. It describes the Bash sandbox as a way for Claude to run most shell commands without stopping to ask permission, by defining which files and which network domains those commands are allowed to touch.

What the settings text omits

No release date has been given for the sandbox option, and the settings text does not say whether it is limited to particular platforms or plans. It also does not list which commands beyond ssh fall outside the sandbox, or how a project declares the override that lifts strict mode. Whether the two settings ship together is unstated.