How Claude Is Contained Across Products

As agents grow more capable, the potential blast radius expands, so Anthropic is building Containment architecture that limits the agent's own permissions to overcome the limitations (such as approval fatigue) of Human-in-the-loop approaches that supervise behavior.

Risk Types and Defense Layers Risks are classified into user misuse, model malfunction, and external attackers. Three layers are used to defend against these:

• Execution environment: Sets physical/logical boundaries through sandboxes, VMs, filesystem boundaries, and egress control.
• Model layer: Adjusts the model's tendencies through system prompts and training.
• External content: Manages the risk when external sources such as MCP servers or third-party plugins are injected into context.

Isolation Patterns by Product

• Ephemeral containers (claude.ai): Uses gVisor containers for code execution to provide a server-side isolated environment. The filesystem operates as ephemeral per session, minimizing the blast radius.
• Human-in-the-loop sandbox (Claude Code): Considering that it runs in the user's local environment, OS-level sandboxes such as Seatbelt on macOS and bubblewrap on Linux were introduced. This reduced permission approval prompts by 84%, addressing approval fatigue.

The key lesson is that containment should be designed at the environment layer first, before the model layer, and that custom-built components you make yourself can become the weakest point in security.