Anthropic releases sandbox-runtime to safely cage AI agents without containers

What you could do with it

• A developer could wrap any AI agent or command-line program in filesystem and network restrictions, keeping it from reading unauthorized files or reaching unapproved websites ¹.
• A developer could sandbox an MCP server so it can only access a specific set of allowed domains and only read or write permitted folders ¹.
• A developer could run their own coding agent inside the sandbox, letting it work freely within fixed boundaries and only asking for permission when it reaches the edge ¹.

What it is and how it works

Anthropic has made the code behind Claude Code's sandboxed bash tool available as a standalone package called sandbox-runtime, often shortened to srt ¹. The tool wraps any process — not just Claude Code — in two kinds of restrictions at once: it decides which files a program can read or write, and it decides which websites or servers it can reach over the internet ².

Rather than spinning up a full virtual machine or container, srt uses each operating system's own built-in safety features. On macOS it relies on sandbox-exec and Seatbelt profiles; on Linux it uses bubblewrap with network namespaces disabled; on Windows support is still in early alpha and uses a dedicated sandbox account plus Windows Filtering Platform rules ¹². Every restriction applies to the entire chain of processes, so child scripts and helper programs run inside the same boundaries as the original command .

By default the tool denies everything: no writing to files unless you explicitly allow it, no reading from folders unless you permit it, and no network access unless a domain appears on an allowlist ¹. Traffic that does go out passes through HTTP or SOCKS5 proxies running on the host, which check those domain lists before letting requests through .

Why both walls matter

Anthropic argues that having only one kind of wall is not enough ¹. A sandbox that blocks the network but leaves the filesystem open could let a compromised agent dump your SSH keys onto a local disk. A sandbox that blocks the hard drive but leaves the internet open could let a prompt-injected agent send those keys out to a remote server. The combined approach is meant to shut both escape routes at the same time .

Anthropic also reports that internal use of the tool cut Claude Code permission prompts by 84 percent ¹. That self-reported number targets a common problem called approval fatigue, where developers grow numb after clicking "approve" dozens of times a day and start saying yes without reading what they are actually approving . With fixed boundaries in place, an agent can work freely inside the sandbox and only asks for help when it reaches the edge .

How developers can use it

The package installs through npm as @anthropic-ai/sandbox-runtime and requires Node.js 22.12 or newer ¹. It ships as both a command-line tool and a TypeScript library called SandboxManager . To sandbox an MCP server, for example, you change the command in your configuration file from npx to srt and pass the original command as arguments, then place your allow and deny rules in a settings file on your home folder . You can also update network rules while a command is already running by swapping in a new list through a control file descriptor .

Anthropic describes the release as a beta research preview and says APIs and configuration formats may change as the project matures ². Windows support is still marked alpha ¹. The package is licensed under Apache-2.0 and comes in at about 11.4 megabytes unpacked .

How good is it

Anthropic reports that internal use of the tool cut Claude Code permission prompts by 84 percent, which the company says directly addresses the common problem of developer 'approval fatigue' where people stop reading prompts after clicking 'approve' dozens of times a day ¹.,The company acknowledges this is a self-reported figure, not an externally verified benchmark .,The tool is currently labeled a beta research preview, and Windows support remains in early alpha .

Key facts

• srt blocks files and network access using built-in OS features, without containers or virtual machines
• Anthropic reports an 84% reduction in permission prompts during internal Claude Code use
• Windows support is still in alpha; the tool is otherwise in beta research preview
• The npm package is Apache-2.0 licensed, about 11.4 MB, and requires Node.js 22.12+

Sources

1. Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers — marktechpost.com
2. GitHub - anthropics/sandbox-runtime: A lightweight sandboxing tool for enforcing filesystem and network restrictions on