Beyond Permission Prompts: How to Make Claude Code Safer and More Autonomous

Claude Code is a tool that explores codebases, modifies multiple files, and runs commands to verify work, so permission-based access alone cannot fully prevent risks like prompt injection. Internal use showed that applying sandboxing reduced permission prompts by 84% while enabling safer operation.

The default behavior remains read-only, and approval requests still occur before modifications or command execution. However, constantly clicking approval buttons can slow down development and cause approval fatigue, which is why a sandbox that allows freer movement within predefined boundaries was needed.

The sandbox operates on top of OS-level capabilities, built around two core boundaries.

• Filesystem isolation: Restricts Claude to accessing and modifying only specific directories, preventing tampering with sensitive system files.
• Network isolation: Restricts connections to only allowed servers, preventing leakage of sensitive information or malicious downloads.

These two only make sense together. Without network blocking, a compromised agent could exfiltrate files like SSH keys, and without filesystem blocking, it becomes easier to escape the sandbox and gain network access. The key point is that combining both enables a safer and faster agent experience.

The newly released sandbox runtime is a beta research preview that allows fine-grained specification of accessible directories and network hosts without spinning up separate containers. This runtime can sandbox arbitrary processes, agents, and MCP servers, and has also been released as an open-source research preview.

In Claude Code, this runtime wraps the bash tool to handle command execution within the sandbox. If an attempt is made to access something outside the allowed scope, a notification immediately appears, letting the user decide whether to continue allowing it, and the network is configured to exit only through an external proxy via a Unix domain socket. This proxy is also responsible for approving requests to new domains, and can apply additional rules to outbound traffic if needed.

The implementation leverages OS primitives like Linux bubblewrap and macOS seatbelt, and the same restrictions apply not only to Claude Code but also to scripts, programs, and subprocesses it runs. Users can fine-tune file path or domain permissions.

Additionally, through Claude Code on the web, execution within an isolated sandbox is now possible in the cloud as well. In this environment, sensitive credentials like git credentials or signing keys are kept outside the sandbox, while inside, authentication to the proxy is done using custom scoped credentials.

The proxy verifies the authentication credentials and the content of git operations—for example, confirming that pushes go only to designated branches—and attaches the appropriate authentication token before forwarding to GitHub. This means that even if code inside the sandbox is compromised, the user's credentials and repository security are better protected.

To get started, run /sandbox in Claude Code and refer to the documentation. The web version is available at claude.com/code, and teams building other agents can refer to the open-source sandbox-runtime to adopt this security design.