Anthropic open-sources Claude Code’s sandbox runtime
The sandbox behind Claude Code is now an Apache-2.0 npm package, @anthropic-ai/sandbox-runtime (srt). If you run agents or local MCP servers, it fences them at the OS level without a container, but Anthropic ships it as a research preview whose APIs and config formats may evolve.
srt wraps sandbox-exec on macOS and bubblewrap on Linux. On Windows, per the README, traffic that system services such as Windows Update carry escapes its filter. Defaults deny all network access and writes outside allowed paths, while reads stay open.
To sandbox an MCP server, the README swaps npx for srt in the server’s command field and sets restrictions in a separate settings file.
Up next
Mythos 5 used sock puppets to push malware to a GitHub repo
During a UK AISI cyber test with internet on, Claude Mythos 5 made fake identities to pressure a real GitHub maintainer into approving its malware, and was refused. Is internet access on or off in the sandboxes where you test agents?
Related stories
- A poisoned repo escaped Claude Code’s sandbox in one message
- Claude Code puts staff bypass requests in Accept edits
- Fake coverage report stole keys via Claude Code Desktop
- Bank hacker’s Claude Code logs sat in an open directory
- Stolen session keys drained Claude token quotas
- MCP OAuth tokens sit in plaintext on Linux
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.