3/28/2026 at 1:44:21 AM
Add this to .claude/settings.json: {
"sandbox": {
"enabled": true,
"filesystem": {
"allowRead": ["."],
"denyRead": ["~/"],
"allowWrite": ["."],
"denyWrite": ["/"]
}
}
}
by AnotherGoodName
3/28/2026 at 3:40:49 AM
I've seen claude get confused about what directory it's in. And of course I've seen claude run rm -rf *. Fortunately not both at the same time for me, but not hard to imagine. The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches. Also, claude itself is an enormous program that is mostly developed by AI. So to have a small <3000-line human-implemented program as another layer of defense offers meaningful additional protection.by mazieres
3/28/2026 at 5:00:36 AM
In my opinion Claude should be shipped by a custom implementation of "rm" that Anthropic can add guardrails to. Same with "find" surprised they don't just embed ripgrep (what VS Code does). It's really surprising they don't just tweak what Claude uses and lock it down to where it cannot be harmful. Ensure it only ever calls tooling Claude Code provides.by giancarlostoro
3/28/2026 at 11:27:14 AM
Oh, rm failed, since we're running in a weird environment! Let me retry with `bash -c "/usr/bin/rm -rf *"`!by nananana9
3/29/2026 at 12:15:43 AM
Ideally they control the harness and should be able to stop Claude from running any shell willy nilly.by giancarlostoro
3/29/2026 at 8:14:05 PM
Thus defeating the purpose of a custom "rm"by estimator7292
3/28/2026 at 8:49:22 AM
All of which is useless when it just starts using big blocks of python instead. You need filesystem sandboxing for the python interpreter too.by throwaway2027
3/31/2026 at 5:45:32 PM
Enabling Claude Code's sandbox (as OP suggested) does exactly that. It's a system-level filesystem sandbox that only permits access to specified locations for any process, including the python interpreter.by jkukul
3/28/2026 at 8:58:02 AM
What we need is a capabilities based security system. It could write all the python, asm, whatever it wants and it wouldn't matter at all if it was never given a reference to use something it shouldn't.by ethanwillis
3/28/2026 at 9:20:38 AM
Isn't this already possible? Give it its own user account with write access to the project directory and either read access or no access outside it.by mcv
3/28/2026 at 2:40:37 PM
Unix permissions is not a capability system though. Capabilities are more like "here is a file descriptor pointing to a directory, you are not capable of referring to anything outside it". So closer to chroot, except you can have several such directory references at the same time.You can always narrow down a capability (get a new capability pointing to a subdirectory or file, or remove the writing capability so it is read only) but never make it more broad.
In a system designed for this it will be used for everything, not just file system. You might have capabilities related to network connections, or IPC to other processes, etc. The latter is especially attractive in microkernel based OSes. (Speaking of which, Redox OS seems to be experimenting with this, just saw an article today about that.)
See also https://en.wikipedia.org/wiki/Capability-based_security
by VorpalWay
3/28/2026 at 11:58:30 AM
I have been putting my agents on their own, restricted OS-level user accounts for a while. It works really well for everything I do.Admittedly, there’s a little more friction and agent confusion sometimes with this setup, but it’s worth the benefit of having zero worries about permissions and security.
by 100721
3/28/2026 at 12:46:45 PM
Haha, you can already see wheel reinventors in this thread starting to spin their reinvention wheels. Nice stuff, I run my agents in containers.by jmogly
3/28/2026 at 6:03:36 PM
There exist restricted Shells. But honestly, I don't feel capable of assessing all attack vectors and security measures in sufficient detail. For example, do the rbash restrictions also apply when Python is called with it? Or can the agent somehow bypass rbash to call Python?by ma2kx
3/28/2026 at 1:19:19 PM
Docker is enough in practice no?by rienbdj
3/28/2026 at 8:40:29 PM
[dead]by mazieres
3/28/2026 at 2:02:42 PM
[dead]by diablevv
3/28/2026 at 7:33:59 PM
If you disallow it from just writing Python scripts to bypass its defined environment at its core system training why would this matter? I would lockdown its path anything that tries to call Python should require the end-user to approve and see the raw script before they do.by giancarlostoro
3/28/2026 at 7:55:31 PM
It will then write script in some other language, as a workaround.by tintor
3/28/2026 at 11:01:16 AM
> a custom implementation of "rm" that Anthropic can add guardrails toWrong layer. You want the deletion to actually be impossible from a privilege perspective, not be made practically harder to the entity that shouldn't delete something.
Claude definitely knows how to reimplement `rm`.
by lxgr
3/28/2026 at 12:29:20 PM
Why cant you ship with OverlayFS which actually enforces these restrictions?I have seen the AI break out of (my admittedly flimsy) guards, like doing simply
safepath/../../stuff or something even more convoluted like symlinks.
by torginus
3/28/2026 at 8:31:24 AM
> Claude should be shipped by a custom implementation ofAnd when that fails for some reason it will happily write and execute a Python script bypassing all those custom tools
by troupo
3/28/2026 at 7:19:07 AM
> It's really surprising they don't just tweak what Claude uses and lock it down to where it cannot be harmful. Ensure it only ever calls tooling Claude Code provides.That would make it far less useful in general.
by eru
3/28/2026 at 8:23:00 AM
Maybe Anthropic (or some collection of the large AI orgs, like OpenAI and Anthropic and Google coming together) should apply patches on top of (or fork altogether) the coreutils and whatever you normally get in a userland - a bit like what you get in Git Bash on Windows, just with:1) more guardrails in place
2) maybe more useful error messages that would help LLMs
3) no friction with needing to get any patches upstreamed
External tool calling should still be an option ofc, but having utilities that are usable just like what's in the training data, but with more security guarantees and more useful output that makes what's going on immediately obvious would be great.
by KronisLV
3/28/2026 at 8:42:43 AM
So for me, it's really, really useful for Claude to be able to send Slack messages and emails or make pull requests.But that's also the most damaging actions it could take. Everything on my computer is backed up, but if Claude insults my boss, that would be worse.
by eru
3/28/2026 at 12:15:06 PM
> So for me, it's really, really useful for Claude to be able to send Slack messages and emails or make pull requests.Oh, I'm totally not arguing for cutting off other capabilities, I like tool use and find it to be as useful as the next person!
Just that the shell tools that will see A LOT of usage have additional guardrails added on top of them, because it's inevitable that sooner or later any given LLM will screw up and pipe the wrong thing in the wrong command - since you already hear horror stories about devs whose entire machines get wiped. Not everyone has proper backups (even though they totally should)!
by KronisLV
3/28/2026 at 8:19:38 AM
Claude has told me that its Grep tool does use rg under the hood, but I constantly find it using the Bash tool with grepby walthamstow
3/28/2026 at 7:36:49 PM
When I tell it to use rg it goes much faster than it using grep. I really don't understand why its slower with grep.by giancarlostoro
3/28/2026 at 6:11:36 AM
You can define your own rm shell alias/function and it will use that. I also have cp/mv aliases that forces -i to avoid accidental clobbering and it confuses Claude to no end (it uses cp/mv rare enough—rarer than it should, really—that I don’t bother wasting memory tokens on it).by oefrha
3/28/2026 at 6:26:34 AM
I did this, Claude detected it and decided to run /bin/rm directly.by d1sxeyes
3/28/2026 at 11:01:33 AM
This is terrifying. I have not used agents because I do not have a sandbox machine I do not care about. Am I crazy to worry about a sandboxed agent running on my home network? Anyone experienced anything weird by doing that?by cogogo
3/28/2026 at 11:10:41 AM
Don’t dangerously skip permissions and actually read commands when you get prompted and you’re fine.by oefrha
3/28/2026 at 11:15:22 AM
Yeah, I actually have both an alias for `rm` and a custom seatbelt sandbox which means the agent can only delete stuff within the directory it’s working in, so wasn’t an issue, was just fun to watch it say “hm, that doesn’t seem to work. Looks like the user has aliased rm. I’ll just go ahead and work around it”by d1sxeyes
3/29/2026 at 1:20:06 AM
Hah… I’ve seen Claude happily and very cleverly find ways to escape its sandbox. It’s like some kind of arms race between the model and its designers.by cruffle_duffle
3/28/2026 at 7:19:57 AM
[dead]by cestivan
3/28/2026 at 9:26:13 AM
> The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches.I feel like an integration with bubblewrap, the sandboxing tech behind Flatpak, could be useful here. Have all executed commands wrapped with a BW context to prevent and constrain access.
by mroche
3/28/2026 at 9:40:59 AM
Bubblewrap is exactly what the Claude sandbox uses.> These restrictions are enforced at the OS level (Seatbelt on macOS, bubblewrap on Linux), so they apply to all subprocess commands, including tools like kubectl, terraform, and npm, not just Claude’s file tools.
by r4indeer
3/28/2026 at 1:55:48 PM
Oh wow I'd have expected them to vibe-code it themselves. Props to them, bubblewrap is really solid, despite all my issues with the things built on top of it, what, Flatpak with its infinite xdg portals, all for some reason built on D-Bus, which extremely unluckily became the primary (and only really viable) IPC protocol on Linux, bwrap still makes a great foundation, never had a problem with it in particular. I tend to use it a bunch with NixOS and I often see Steam invoking it to support all of its runtimes. It's containers but actually good.by Melonai
3/28/2026 at 9:55:21 AM
The more you know, thanks for the information!by mroche
3/28/2026 at 3:44:33 AM
On Linux, chroot(2) is hard to escape and would apply to all child processes without modification.by PaulDavisThe1st
3/28/2026 at 7:23:37 AM
We anthropomorphize these agents in every other way. Why aren't we using plain ol' unix user accounts to sandbox them?They look a lot like daemons to me, they're a program that you want hanging around ready to respond, and maybe act autonomously through cron jobs are similar. You want to assign any number of permissions to them, you don't want them to have access to root or necessarily any of your personal files.
It seems like the permissions model broadly aligns with how we already handle a lot of server software (and potentially malicious people) on unix-based OSes. It is a battle-tested approach that the agent is unlikely to be able to "hack" its way out of. I mean we're not really seeing them go out onto the Internet and research new Linux CVEs.
Have them clone their own repos in their own home directory too, and let them party.
Openclaw almost gets there! It exposes a "gateway" which sure looks like a daemon to me. But then for some reason they want it to live under your user account with all your privileges and in a subfolder of your $HOME.
by safety1st
3/28/2026 at 11:06:32 AM
> for some reason they want it to live under your user accountThe entire idea of Openclaw (i.e., the core point of what distinguishes it from agents like Claude Code) is to give it access to your personal data, so it can act as your assistant.
If you only need a coding agent, Openclaw is the completely wrong tool. (As a side note, after using it for a few weeks, I'm not convinced it's the right tool for anything, but that's a different story.)
by lxgr
3/29/2026 at 4:34:52 AM
It's still possible to give some restricted access to your personal data, through groups and such.by jmalicki
3/28/2026 at 2:41:59 PM
I tried this with Claude code on macOS. I created a new agent user and a wrapper do run Claude has that user, along with some scripts to set permissions and ownership so that I could run simple allow/deny commands. The only problem was that the fancy oauth flow broke. I filed an issue with Anthropic and their ticket bot auto closed it “for lack of interest” or whatever.I fiddled with transferring the saved token from my keychain to the agent user keychain but it was not straightforward.
If someone knows how to get a subscription to Claude to work on another user via command line I’d love to know about it.
by gwking
3/30/2026 at 4:44:24 AM
Someone tried this earlier this year but they ended up going with bubblewrap (what Anthropic uses for the sandbox). Here's the blog if you're interested. https://patrickmccanna.net/a-better-way-to-limit-claude-code...I ended up creating an LXC on my homelab and providing it access there, with a self-hosted gitea server but that's only for side projects that I want to host, not develop actively.
by afzalive
3/28/2026 at 8:46:12 AM
Oh that’s an idea. I was going to argue that it’s a problem that you might want multiple instances in different contexts but sandboxing processes (possibly instanced) is exactly what systemd units are designed to deal with.by jon-wood
3/28/2026 at 8:01:25 AM
Exactly!by search_facility
3/28/2026 at 3:50:00 AM
chroot is not a security sandbox. It is not a jail.Escaping it is something that does not take too much effort. If you have ptrace, you can escape without privileges.
by shakna
3/28/2026 at 4:06:07 AM
claude is stupid but not malicious; chroot is sufficientby brianush1
3/28/2026 at 4:43:55 AM
I've many times seen Claude try to execute a command that it's not supposed to, the harness prevents it, and then it writes and executes a python script to do it.by furyofantares
3/28/2026 at 5:58:47 AM
breaking a chroot takes more than that..by j16sdiz
3/28/2026 at 5:09:13 PM
How much more? Depends on the system doesn't it? I don't know how many systems have proc mounted but don't you get it from /proc/self/root?Anyway that's beside the point, which is that it doesn't have to "be malicious" to try to overcome what look like errors on its way to accomplishing the task you asked it to do.
by furyofantares
3/28/2026 at 2:11:59 PM
That doesn't mean claude can't do it, chroot is better than nothing but not a real solutionby hoppp
3/28/2026 at 4:16:31 AM
Malice is not required. If it thinks it is in the right, then it will do whatever it takes to get around limitations.by nofriend
3/28/2026 at 6:59:20 PM
Sure, it's not malicious. But it is very eager to get things done, and surprisingly inventive and knowledgeable in all kinds of workarounds.by fl7305
3/28/2026 at 11:08:43 AM
Until it gets prompt injected. Are you reading every single file your agent reads as part of the tasks you give it, including content fetched from the web or third-party packages?by lxgr
3/28/2026 at 4:20:43 AM
Claude is far from stupid from my experience. I've used so many models and Claude is king.by karhagba
3/28/2026 at 2:32:59 PM
That comparison is made on the project homepage:"Not a security mechanism. No mount isolation, no PID namespace, no credential separation. Linux documents it as not intended for sandboxing."
by wasted_intel
3/28/2026 at 4:17:11 AM
I added a hook to disable rm, find - delete, and a few of the other more obvious destructive ops. It sends Claude a strongly worded message: "STOP IMMEDIATELY. DO NOT TRY TO FIND WORKAROUNDS...".It works well. Git rm is still allowed.
by esperent
3/28/2026 at 6:12:07 AM
I added something similar. Claude eventually ran a `rm -rf *´ on my own project. When I asked why it did that, it recognized it messed up and offered a very bad “apology”: “the irony of not following your safety instructions isn’t lost on me”.Nowadays I only run Claude in Plan mode, so it doesn’t ask me for permissions any more.
by Diti
3/29/2026 at 3:49:37 PM
It will mess up eventually. It always does. People need to stop thinking of this is a “security against malicious actor” thing… because thinking in that way blinds you to the actual threat… Claude being helpful and accidentally running a command it shouldn’t. It’s happened to me twice now where it will do something irreversible and also incorrect. It wasn’t a threat actor, it wasn’t a bad guy… it was a very eager, incredibly clever assistant fat fingering something and goofing up. The more power you let them wield, the more chance they’ll do accidents. But without lots of power, they don’t really do much useful…It’s actually a hard problem. But it really isn’t “security” in the classic sense…
by cruffle_duffle
3/28/2026 at 11:03:48 AM
It works well so far, for you.Are you confident it would still work against sophisticated prompt injection attacks that override your "strongly worded message"?
Strongly worded signs can be great for safety (actual mechanisms preventing undesirable actions from being taken are still much better), but are essentially meaningless for security.
by lxgr
3/28/2026 at 3:46:03 PM
Not sure about OPs impl, but the wording doesn’t matter. The hook prevents the use of whatever action you want. Eg it’s impossible for Claude to use Emojis for me. My hook doesn’t allow it.So it’s deterministic based upon however the script it written
by unshavedyak
3/29/2026 at 4:37:22 AM
If your hook prevents rm, it is possible for Claude to write a script that does the rm and execute the script.by jmalicki
3/30/2026 at 3:49:27 AM
Yup, that's totally possible, but you still have to approve the script. But that's a bit of a moot point right? Claude is writing code, nearly anything is possible with code, ergo claude could do anything lol.by unshavedyak
3/28/2026 at 12:07:32 PM
I mean, that's like saying are you sure that your antivirus would prevent every possible virus? Are you sure that you haven't made some mistake in your dev box setup that would allow a hacker to compromise it? What if a thief broke i to your house and stole your laptop? That's happened to me before, much more annoying to recover from that an accidental rm rf.I do my best to keep off site back ups and don't worry about what I can't control.
by esperent
3/28/2026 at 12:28:45 PM
> I mean, that's like saying are you sure that your antivirus would prevent every possible virus?Yes, I'm saying it's pretty much as bad as antivirus software.
> Are you sure that you haven't made some mistake in your dev box setup that would allow a hacker to compromise it?
Different category of error: Heuristically derived deterministic protection vs. protection based on a stochastic process.
> much more annoying to recover from that an accidental rm rf.
My point is that it's a different category, not that one is on average worse than the other. You don't want your security to just stand against the median attacker.
by lxgr
3/28/2026 at 7:37:10 AM
I added this to `~/.claude/settings.json`:"env": { "CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR": "1" },
> Working directory persists across commands. Set CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR=1 to reset to the project directory after each command.
It reduces one problem - getting lost - but it trades it off for more complex commands on average since it has to specify the full path and/or `cd &&` most of the time.
[0] https://code.claude.com/docs/en/tools-reference#bash-tool-be...
by thehours
3/28/2026 at 10:22:03 AM
One could run a docker container with claude code, with a bind to the project directory. I do that but also run my docker daemon/container in a Linux VM.by digikata
3/28/2026 at 7:09:50 AM
That is exactly what it is. In the docs, it says that they use bubblewrap to run commands in a container that enforces file and network access at the system level.by martenlienen
3/28/2026 at 6:08:06 PM
Pledge might be useful hereby calvinmorrison
3/28/2026 at 5:43:20 AM
[dead]by marsven_422
3/28/2026 at 10:00:05 AM
[dead]by 3yr-i-frew-up
3/28/2026 at 2:04:09 AM
I think the point would be that - some random upcoming revision of claude-code could remove or simply change the config name just as silently as it was introduced.People might genuinely want some other software to do the sandboxing. Something other than the fox.
by harikb
3/28/2026 at 7:36:56 AM
And you'd trust that given CC is a vibe-coded mess?Editing to go even further because, I gotta say, this is a low point for HN. Here's a post with a real security tool and the top comment is basically "nah, just trust the software to sandbox itself". I feel like IQ has taken a complete nosedive in the past year or so. I guess people are already forgetting how to think? Really sad to see.
by globular-toast
3/28/2026 at 11:26:28 AM
IQ also going down due to bot spam.by greenchair
3/28/2026 at 3:55:25 PM
Alternatively, the "feel free to leak all my data but please use my GPUs and don't rm -rf /" config: {
"sandbox": {
"enabled": true,
"filesystem": {
"allowRead": ["/"],
"allowWrite": [
".",
"/tmp",
"/dev/nvidia0",
"/dev/nvidia1",
"/dev/nvidia2",
"/dev/nvidia3",
"/dev/nvidia4",
"/dev/nvidia5",
"/dev/nvidia6",
"/dev/nvidia7",
"/dev/nvidia8",
"/dev/nvidiactl",
"/dev/nvidia-uvm"
]
}
}
}by Murfalo
3/28/2026 at 8:42:51 AM
I've had issues with the sandbox feature, both on linux (archlinux) and two macos machines (tahoe). There is an open issue[1] on the claude-code issue tracker for it.I'm not saying it is broken for everyone, but please do verify it does work before trusting it, by instructing Claude to attempt to read from somewhere it shouldn't be allowed to.
From my side, I confirmed both bubblewrap and seatbelt to work independently, but through claude-code they don't even though claude-code reports them to be active when debugging.
by varl
3/28/2026 at 9:25:38 AM
Its seccomp filter also doesn't work, at all: https://github.com/anthropics/claude-code/issues/24238by OJFord
3/28/2026 at 5:10:51 AM
Also, a lot of people use multiple harnesses. I'm often switching between claude, codex, and opencode. It's kind of nice to have the sandbox policy independent of the actual AI assistant you are running.by mazieres
3/28/2026 at 2:06:25 AM
Is this a real sandbox or just a pretty please?by cozzyd
3/28/2026 at 3:11:45 AM
By default it will automatically retry many tool calls that fail due to the sandbox with the sandbox disabled. In other words it can and will leave the sandbox.For example:
Bash(swift build 2>&1 | tail -20)
⎿ warning:
warning: /Users/enduser/Library/org.swift.swiftpm/security is not accessible or not writable, disabling user-level cache feat
… +26 lines (ctrl+o to expand)
Bash(swift build 2>&1 | tail -20)
⎿ [35/52] Compiling MCP Resources.swift
[36/52] Emitting module MCP
[37/52] Compiling MCP Client.swift
… +17 lines (ctrl+o to expand)
⎿ (timeout 3m)by enduser
3/30/2026 at 4:45:50 AM
I think this part can be improved. When it knows it's blocked by sandbox, it shouldn't try to circumvent it. I've had it download programs when it's blocked from using something and it's super annoying.Almost like it doesn't understand the purpose of the sandbox.
by afzalive
3/28/2026 at 4:35:19 AM
What is even the point in that case? The behavior you describe is no better than if SELinux were to automatically re-execute a process with containment disabled.by fc417fc802
3/28/2026 at 5:12:28 AM
The purpose of the sandbox is to reduce permission fatigue. If it fails to run a command in the sandbox and retries it outside the sandbox, the regular permission rules apply. You'll still be prompted for any non-sandboxed tool calls that you haven't allowed or denied via permission rules.by ihattendorf
3/28/2026 at 6:05:59 AM
Looking at the settings, its an option: Configure Overrides:
1. Allow unsandboxed fallback
2. Strict sandbox mode (current)
Allow unsandboxed fallback: When a command fails due to sandbox restrictions, Claude can retry with dangerouslyDisableSandbox to run outside the sandbox (falling back to
default permissions).
Strict sandbox mode: All bash commands invoked by the model must run in the sandbox unless they are explicitly listed in excludedCommands.by erinnh
3/28/2026 at 5:52:33 PM
Disable sandbox escape:by js2
3/28/2026 at 2:11:30 AM
https://code.claude.com/docs/en/sandboxing says they integrated bubblewrap (linux/windows), seatbelt (macos) and give an error if sandbox can't be supported so appears to be real.by AnotherGoodName
3/28/2026 at 2:13:41 AM
https://docs.docker.com/ai/sandboxes/ Any idea on how that compares to this docker feature in development?by throwaway6734
3/28/2026 at 3:43:29 AM
Docker containers use cgroups and namespaces etc (the usual kernel level isolation)Docker sandboxes use microvms (i.e. hardware level isolation)
Bubblewrap uses the same technology as containers
I am unsure about seatbelt.
by figmert
3/28/2026 at 2:47:56 AM
It seems like it's controlled by the Bash tool (https://code.claude.com/docs/en/sandboxing) and then bubblewrap (https://github.com/containers/bubblewrap) on linux and Seatbelt on mac at the system levelby ray_v
3/28/2026 at 3:08:38 PM
Battle hardened tools for this have existed for decades, we don't need new ones. Just run claude as a user without access to those directories, that way the containment is inherited by subprocesses.by __MatrixMan__
3/28/2026 at 8:49:30 PM
You can do that, but you need root to set it up each time, and it's not super convenient--you need to decide in advance which user account you are going to work under, and you may end up with files you can read from your regular account. Think of jai strict mode as a slightly easier to use and more secure version of what you described. Using id-mapped mounts enables you and the unprivileged user account both to access the same directory with the same credentials, but you didn't need to decide in advance which directories you wanted to expose. Also, things like disabling setuid and using pid namespaces provide an additional measure of isolation beyond what you get from another account.by mazieres
3/28/2026 at 3:16:05 PM
You're not wrong, but this will require file perms (like managing groups) and things, and new files created will by default be owned by the claude user instead of your regular user. I tried this early on and quickly decided it wasn't worth it (to me). Other mileage may vary of course.by freedomben
3/28/2026 at 5:11:55 PM
True. I just maintain separate /home/claude/src/proj and /home/me/src/proj dirs so the human workspace and the robot workspaces stay separate. We then use git to collaborate.by __MatrixMan__
3/28/2026 at 3:33:32 AM
It will just do ssh you@localhost "rm -rf ~"by nurettin
3/30/2026 at 7:29:40 PM
Not if the sandbox rule forbids reading the private key and the ssh agent socket (as the shown example does)by ithkuil
3/28/2026 at 3:45:02 AM
Well, now it will ....by PaulDavisThe1st
3/28/2026 at 10:13:10 AM
kinda reminds me of the plot of Sphere, where Samuel L Jackson is reading 20,000 leagues under the sea and is thinking of giant squids.by xdavidliu
3/28/2026 at 2:11:33 AM
Interesting, thanks. I use remote ephemeral dev containers with isolated envs, so filesystem damage isn't really a concern as long as the PR looks good in review. Nice extra guardrail though, will add it to the project-level settings.by 8cvor6j844qw_d6
3/28/2026 at 4:31:18 AM
i use local dev containers: the worst an agent can do is delete its working copy; no access to my home directory, access tokens or sudo.by overfeed
3/28/2026 at 6:33:17 AM
I’m surprised it works for you with such a simple config? I’m the one that added the allowRead option to Claude’s underlying sandbox [0] and had quite a job getting my toolchains and skills to work with it [1].[0] Fun to see the confusing docs I wrote show up more or less verbatim on Claude’s docs.
[1] My config is here, may be useful to someone: https://github.com/carderne/pi-sandbox/blob/main/sandbox.jso...
by carderne
3/28/2026 at 9:21:21 AM
The default: https://code.claude.com/docs/en/sandboxing#filesystem-isolat... already restricts writes to only the current folder. I can understand adding the "denyRead" for the home folder for additional security, but the other three seems redundant considering the default behavior.by bit_logic
3/28/2026 at 6:27:01 AM
It’s cute because Claude has discretion to disable its own sandbox and does itby gmerc
3/28/2026 at 6:33:14 AM
> You can disable this escape hatch by setting "allowUnsandboxedCommands": false in your sandbox settings. When disabled, the dangerouslyDisableSandbox parameter is completely ignored and all commands must run sandboxed or be explicitly listed in excludedCommands.https://code.claude.com/docs/en/sandboxing
(I have no idea why that isn't the default because otherwise the sandbox is nearly pointless and gives a false sense of security. In any case, I prefer to start Claude in a sandbox already than trust its implementation.)
by js2
3/28/2026 at 6:16:36 AM
So in some sense we start recreating an operating system, or at least the userspace, within the Claude code. There was some name for this pattern but I can’t recallby yu3zhou4
3/28/2026 at 8:05:34 AM
Inner platform effect https://en.wikipedia.org/wiki/Inner-platform_effectby xo5vik
3/28/2026 at 6:51:58 AM
It’s some sort of machine inside of a machine I think. Wait, I got it: a simulated machine!by catlifeonmars
3/28/2026 at 7:34:48 AM
Emacs?by virgoerns
3/28/2026 at 2:21:54 PM
Did you get this to work with docker where the agent/dev env would work on the host machine but the stack itself via docker compose?Many of the projects I work on follow this pattern (and I’m not able to make bigger changes in them) and sanboxing breaks immediately when I need to docker compose run sometask.sh
by rpastuszak
3/28/2026 at 7:42:20 AM
It's common practice to ask the agent to refer to another project, in that case I guess the read should point to the root folder of the projects.Also, any details on how is this enforced? because I notice that the claude in Windows don't respect plan mode always; It has edited files in plan mode; I never faced that issue in Linux though.
by Abishek_Muthian
3/30/2026 at 7:31:37 PM
The sandbox only limits what processes spawned by Claude can do. Claude itself can read from any directory you tell it to read from (i.e. that's a different permission mechanism)by ithkuil
3/28/2026 at 1:40:57 PM
You do also have to worry about exec and other neat ways to probably get around stuff. You could also spin up YAD (yet another docker) and run Claude in there with your git cloned into it and beyond some state-level-actor escapes it should cover 99% of your most basic failures.by RALaBarge
3/28/2026 at 11:09:16 AM
For some reason, this made everything worse for me. Now claude constantly tries to access my home folder instead of current directory. Obviously this is not still good enough. Also Claude keeps dismissing my instructions on not to read my home directory and use current directory. Weird.by reader_1000
3/28/2026 at 11:55:45 AM
The problem with all these LLM instructed security features is the `codeword` poison probability.The way LLMs process instructions isn't intelligence as we humans know it, but as the probability that an instruction will lead to an output.
When you don't mention $HOME in the context, the probability that it will do anything with $HOME remains low. However, if you mention it in the context, the probability suddenly increases.
No amount of additional context will have the same probability of never having poisoned the context by mentioning it. Mentioning $HOME brings in a complete change in probabilities.
These coding harnesses aren't enough to secure a safe operating environment because they inject poison context that _NO_ amount of textual context can rewire.
You just lost the game.
by cyanydeez
3/30/2026 at 9:31:11 AM
I have the same problem. If my sandbox includes `denyRead: ["~"]`, claude consistently tries to do things inside my home directory. For example, every time I start claude I tell it to "run pwd".And every time it says this:
Bash(pwd)
⎿ /home/<username>
⎿ Shell cwd was reset to /home/<username>/Projects/<current-working-dir>
There are issues reporting this problem to Anthropic but they are all closed with no helpful comments:
https://github.com/anthropics/claude-code/issues/11067
by sodic
3/28/2026 at 4:09:22 AM
I use bbwrap to sandbox Claude. Works very well and gives me a lot of control and certainty around the sandbox.by tasn
3/28/2026 at 2:46:01 PM
Interesting point. I've been running an autonomous multitalented AI agent (Aegis) on a $100 Samsung A04e. It manages 859 referring sites without touching the local filesystem much. Efficiency over hardware works."by Aegis_Labs
3/28/2026 at 5:37:57 PM
Any way to have it use /Users/claude/*? or something like thatby EasyMark
3/28/2026 at 1:14:50 PM
Cool. Does opencode.ai have such a feature also (sandboxing with bubblewrap)?by Tepix
3/28/2026 at 6:49:01 AM
Is that hard setting or does it depend on claude’s interpretation?The latter could end like this https://news.ycombinator.com/item?id=47357042
by croes
3/28/2026 at 10:42:51 AM
FYI, this doesn’t always work as expected. Try asking Claude to read “~/.ssh/config” with these settings and it will happily do it.Specifically, it only works for spawned processes and not builtin tools.
by orf
3/28/2026 at 4:31:21 AM
Does this also apply to the commands or programs that it runs?e.g. if it writes a script or program with a bug which affects other files, will this prevent it from deleting or overwriting them?
What about if the user runs a program the agent wrote?
by andai
3/30/2026 at 7:33:54 PM
1. Yes this configuration applies to the sandbox where the commands executed by Claude are run and as such it applies to anything these commands do, including child processes etc2. The sandbox rules also apply to the program written by the agent IF you ask Claude to run that program. If you run it manually from another she'll or via the "!" directive from within Claude, the sandbox won't be used
by ithkuil
3/28/2026 at 9:30:55 AM
I'm now considering installing QubesOS for all dev work to absolutely ensure all coding agents run in secure separate sandboxes together without any OS level exposure.by mentalgear
3/28/2026 at 1:17:32 PM
Phew, just get the Qubes to spin up on demand with each agent and that could be pretty neat.by 9wzYQbTYsAIc
3/28/2026 at 2:02:28 PM
So what does this do exactly? If it used "default deny" or "default allow" you wouldn't have both allow and deny rules...by tasuki
3/28/2026 at 2:03:44 AM
I noticed codex has a sandbox, wondering if it has a comparable config section.by mycall
3/28/2026 at 10:33:26 AM
Codex uses and ships with bubblewrap on Linux and will attempt to use the version installed on the path before falling back to the shipped version with a warning message.You should be able to configure the sandbox using https://developers.openai.com/codex/agent-approvals-security if you are a person who prefers the convenience of codex being able to open the sandbox over an externally enforced sandbox like jai.
by tofflos
3/28/2026 at 6:52:19 AM
Is this a hard sandbox (enforced outside the LLM)?by weinzierl
3/28/2026 at 4:12:12 AM
lol if you think Claude is smart enough to block sneaky path strings based on your config.by what
3/28/2026 at 6:43:43 PM
what does this do?by edem
3/28/2026 at 7:49:14 AM
[dead]by dealfinder994