AI Agent UpdateAnthropic open-sources sandbox-runtime: Claude Code's sandbox, without the container
Anthropic open-sourced the sandbox behind Claude Code — agent safety without the heavy container, and with far fewer permission pop-ups.
The News
Anthropic released sandbox-runtime, known as srt, on October 24, open-sourcing the sandbox that sits behind Claude Code. It is released under the Apache-2.0 open-source licence, which means anyone can use, modify and build on it freely. The tool confines an AI agent, its MCP servers and its command-line tools at the operating-system level — without needing a container. Containers are the usual way to fence off software, but they are heavyweight: they need setup, resources and expertise. Sandbox-runtime instead uses the operating system's own built-in fencing: Seatbelt on macOS and bubblewrap on Linux, with Windows support in alpha.
The security defaults are strict in a useful way. Network access is denied by default, and only whitelisted domains — websites and services explicitly approved in advance — can be reached, via HTTP or SOCKS5 proxies. That is a deliberately paranoid starting point: instead of letting an agent reach the whole internet and blocking the bad parts, it blocks everything and allows only the good parts. For agents that run code, browse files and call tools on your behalf, that default flips the usual risk: a compromised or confused agent has far fewer places to go and far less damage it can do.
Anthropic also published a striking self-reported internal result: 84% fewer Claude Code permission prompts when sandboxing is used. Permission prompts are the pop-ups that ask you to approve each action an agent wants to take, and they are the great annoyance of agent tools — approve too much and you stop reading them, approve too little and nothing gets done. Cutting them by 84% would mean agents that interrupt far less while still staying fenced in. That figure is Anthropic's own internal basis, not an independent measurement, so treat it as promising rather than proven.
Block everything, allow only the good parts — sandbox-runtime flips agent security from a blacklist to a whitelist.
Why It Matters
To see why this matters, consider what AI agents actually do. An agent is not a chatbot that just answers questions: it runs commands, edits files, calls tools and connects to services on your behalf. That power is the point, but it is also the risk. A single mistaken instruction — or a malicious instruction hidden in a web page or file the agent reads — could delete data, leak secrets or reach out to an attacker's server. Until now, the main answers were containers, which many developers find heavy, or endless permission pop-ups, which users learn to click through blindly.
Sandbox-runtime offers a third path that is lighter and stricter at the same time. By using the operating system's own fencing tools, it avoids the overhead of a container while still confining the agent, its MCP servers and its tools. And by denying network access by default, it changes the security question from 'did we block every bad site?' to 'did we approve every good one?' The second question is far easier to answer correctly. That combination — lighter to run, harder to escape — is why this release matters beyond Anthropic's own products.
The open-source licence is the other half of the story. Apache-2.0 means any developer or company can adopt sandbox-runtime, adapt it and build on it without paying Anthropic or asking permission. If it catches on, it could become shared infrastructure for agent safety, the way common web standards became shared infrastructure for the internet. That would benefit the whole agent ecosystem, including competitors, which is presumably why Anthropic framed it as a research preview: the goal is adoption and feedback, not a finished commercial product.
Analyst's Take
This is a Bullish verdict for the practical future of AI agents. The biggest obstacle to agents doing real work has never been intelligence alone; it has been trust. Nobody wants an agent with the run of their computer, their files and the internet, and nobody wants to babysit every action with a permission pop-up either. Sandbox-runtime attacks both problems at once: operating-system fencing that is lighter than containers, and a whitelist approach to the network that limits blast radius if something goes wrong. Open-sourcing it under Apache-2.0 invites the whole ecosystem to adopt and improve it, rather than locking the safety benefit inside one company's product.
The caveats are real but do not change the direction. Beta status, changing config formats and the need for production hardening mean this is not yet a drop-in enterprise solution, and the 84% prompt reduction needs independent confirmation. Anthropic itself is private, so the tickers here are investor read-throughs only: Amazon (AMZN) and Alphabet (GOOGL) are Anthropic investors, not the company releasing the tool, and their shares will not move on this alone. Still, a lighter, stricter, open sandbox is exactly the kind of unglamorous infrastructure that lets agents move from demos to daily work. Readers' poll: would you trust an AI agent more if it ran in a sandbox like this?
By The Numbers
FAQ
What is a sandbox?
A sandbox is a fenced-off area where a program can run without touching the rest of the computer. If the program inside misbehaves — deleting the wrong file, say, or reaching out to a dodgy website — the fence stops the damage from spreading to your documents, your system or your network. It is the difference between letting a guest use your whole house and giving them one locked room to work in.
What are MCP servers?
MCP stands for Model Context Protocol, a standard way for AI tools to connect to outside data and services. An MCP server is a small program that gives an AI agent access to something specific, like a database, a file system or a company tool. The catch is that each connection is also a potential way for something to go wrong, which is why sandboxing them — fencing them off too — matters.
Can I use sandbox-runtime in production today?
Not without caution. It is a beta research preview, and Anthropic says configuration formats may change, so anything built on it today may need reworking. Adoption also needs production hardening: the extra testing, monitoring and safety work that turns a promising research tool into something you can trust with real systems and real data. Treat it as a strong direction, not a finished product.
Source: MarkTechPost