Anthropic publishes documentation of sandbox techniques used across Claude.ai, Claude Code, and Cowork

Anthropic released a detailed overview explaining how it constrains agent behavior using process sandboxes, virtual machines (VMs), filesystem boundaries, and egress controls—with the goal of preventing agents from accessing credentials or exfiltrating data regardless of the cause.

Each Claude product uses different sandbox implementations: Claude.ai runs gVisor; Claude Code uses Seatbelt on macOS and Bubblewrap on Linux; Claude Cowork runs a full VM via Apple's Virtualization framework on macOS or HCS on Windows.

The documentation includes examples of previously missed security risks, such as an api.anthropic.com/v1/files exfiltration vector that Anthropic had identified.