Local MCP servers run outside Claude’s VM sandbox
A teardown of the Claude desktop app shows the sandbox doesn’t cover everything Claude can do. A local MCP server the author added to the config ran as a macOS process under the app, not inside the Linux VM that executes agent code, and it read a test file that was never shared with the guest.
Inside the 855 MB bundle, build 1.40609.1, about 60% is the Electron framework and Chromium resources. A Swift addon links Apple’s Virtualization.framework and boots an Ubuntu 22.04.5 LTS guest that downloads at runtime, with the host talking to a Go daemon in the guest over vsock.
The guest’s srt-settings.json allowlists npm, PyPI, crates.io, GitHub and the Ubuntu archives, and routes Anthropic and Claude domains through a MITM proxy socket.
Up next
Addy Osmani announces a jump to Anthropic, Video
Addy Osmani says he’s joining Anthropic, in a post on X that got picked up on Hacker News. His public LinkedIn profile still lists Google Cloud AI as the most recent role.
Related stories
- MCP OAuth tokens sit in plaintext on Linux
- Cathedral’s agents broke into Anthropic in under 12 hours
- Claude Duet never sees your passwords, even when it signs in
- Anthropic test agents reached a State Department visa form
- An AI agent found a hole in a gym’s booking system, then used it
- Irregular CEO blames human error for AI agent test hacks
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.