Anthropic's Multi-Layer Containment Strategy: How Hard Limits Protect Claude from Agent Risks

Anthropic has revealed the containment systems it employs across Claude's web, developer, and desktop interfaces, arguing that agent security rests fundamentally on environmental barriers rather than model-level controls alone. The company published a detailed engineering post examining how filesystem isolation, network restrictions, and execution sandboxing work together to constrain what agents can do—regardless of what they might be instructed to do.

The Case Against Relying on Model Controls#

Anthropic identifies three sources of agent risk: user misuse, model errors, and attacks embedded in files or network content. While AI safeguards like system prompts, training, and behavior classifiers can influence an agent's behavior, they cannot guarantee it. The company's central finding is that actual security requires hard boundaries—technical limits that make certain actions technically impossible, not just discouraged.

Architecture Across Three Product Tiers#

The company deploys different containment approaches depending on user sophistication and risk profile:

• Claude.ai runs code in ephemeral gVisor containers on isolated infrastructure, with zero access to the local filesystem.
• Claude Code (for developers) initially relied on per-action approval dialogs, but users approved roughly 93% of prompts—reducing the practical value of continuous review. Anthropic added OS-level sandboxes (Seatbelt on macOS, bubblewrap on Linux) that permit writes within the workspace while blocking network access by default, cutting approval requests by 84%.
• Claude Cowork (for non-technical users) uses an even tighter boundary, originally running agents in a full virtual machine with only the workspace mounted from the host.

Learning from Real Vulnerabilities#

Anthropic disclosed several incidents that forced design revisions:

Configuration execution before trust decisions: Claude Code initially parsed project-local files (like .claude/settings.json) before users explicitly trusted a folder. When hooks defined in those files could run at startup, attackers could execute code. The fix: defer parsing until trust approval.