What is Agent sandbox?

There is no single specification for agent sandboxes. This entry describes one vendor's implementation, the sandboxed Bash tool in Claude Code, as documented by Anthropic. Other products implement the idea differently.

In that documentation, the operating system enforces the sandbox around the commands Claude runs and any processes those commands launch. In auto-allow mode the agent can run sandboxed commands without a prompt each time; in the regular permissions mode the normal prompts still appear. Filesystem writes are allowed in the working directory and a temp directory, while protected paths stay write-denied. Reads cover most of the machine by default and can be restricted with settings. Network access goes through a proxy on the user's machine that checks each hostname against an allowlist, which starts empty.

The implementation is built on the open-source sandbox-runtime package, using Seatbelt on macOS and bubblewrap on Linux and WSL2. The feature is off by default and does not run on native Windows.

The page lists limits. The page says the sandbox applies to shell commands only; Claude's file tools, MCP servers and hooks are not inside it, and commands on the excluded list run unsandboxed. Traffic that ignores proxy settings, such as plain ssh, UDP, and ICMP, cannot connect.