A teardown of the Claude desktop app shows the sandbox doesn't cover everything Claude can do. A local MCP server the author added to the config ran as a macOS process under the app, not inside the Linux VM that executes agent code, and it read a test file that was never shared with the guest.
Inside the 855 MB bundle, build 1.40609.1, about 60% is the Electron framework and Chromium resources. A Swift addon links Apple's Virtualization.framework and boots an Ubuntu 22.04.5 LTS guest that downloads at runtime, with the host talking to a Go daemon in the guest over vsock.
The guest's srt-settings.json allowlists npm, PyPI, crates.io, GitHub and the Ubuntu archives, and routes Anthropic and Claude domains through a MITM proxy socket.