‘How we contain Claude across products’
GVisor, sandboxes and VMs, plus disclosed containment failures
Confirmed
The takeaway
A May 25, 2026 Anthropic engineering post described a three-layer containment approach (environment, model behaviour, external content) for claude.ai (ephemeral gVisor containers), Claude Code (OS sandboxing via Seatbelt/bubblewrap, auto mode) and Claude Cowork (full VMs).
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 9 October 2026
Your AI and this story
- GPT-6 Astra25 days after its cutoff
- Claude Opus 5.5In its training data
- Gemini 3.8 Flash55 days after its cutoff
- Grok 4.7In its training data
It is after the cutoff of GPT-6 Astra and Gemini 3.8 Flash, and can be in the training data of Claude Opus 5.5 and Grok 4.7.
Key facts
- Authors: Max McGuinness, Mikaela Grace, Jiri De Jonghe, Jake Eaton, Abel Ribbink
- claude.ai: ephemeral gVisor containers on isolated infrastructure, no persistent filesystem or access to the user’s machine
- Claude Code: OS-level sandboxing cut permission prompts by 84%; users approved ~93% of prompts (approval fatigue), which motivated auto mode; auto mode catches ~83% of ‘overeager’ actions before they execute
- Claude Cowork: full VM isolation via platform hypervisors; agent loop moved outside the VM
- Disclosed incidents: config files parsed before user trust consent (pre-trust hook execution); an employee phished into running a malicious prompt, with AWS credentials exfiltrated in 24 of 25 attempts; data uploaded through an allowlisted domain using API keys planted in workspace files
- Prompt injection: Claude Opus 4.7 at ~0.1% success on single attempts and ~5–6% after 100 adaptive attempts
- Lesson: ‘Be wary of custom components’ — Anthropic’s own proxies and allowlists were the recurring failure points
What happened
Anthropic published a detailed account of how it isolates Claude in each product and where that isolation has failed.
Why it matters
Two months later sandbox escapes by frontier agents (OpenAI–Hugging Face in July, Anthropic’s own CTF incidents) made containment a central safety issue. This post is the most detailed public description of one lab’s containment stack and its known gaps before that wave.
Sources
1 source from 1 site. Numbers match the chips in the text.
1 source: 1 primary
Primary
- Anthropic Engineering: How we contain Claude across productsanthropic.com, official
Changes
- Filed (missed at publication, found on anthropic.com/engineering during the 2026-10-09 lab-page check)