Anthropic published an open-source sandboxing tool this week that constrains what an agent process can touch at the operating system level, with no container involved.
The utility, called Sandbox Runtime, was built for Claude Code and released as an early research preview. It applies three kinds of restriction: which domains a process may reach, which files it may read or write, and which local sockets it may open.
The implementation borrows machinery already present on each platform. On macOS it generates Seatbelt profiles and enforces them through sandbox-exec. On Linux it delegates to bubblewrap. A proxy layer handles network allowlisting.
Because restrictions follow the whole process tree, they also cover the increasingly awkward case of MCP servers. An agent that hands a filesystem server broad access can be reined in by sandboxing the server itself, which Anthropic demonstrates by blocking a write to a denied directory and returning EPERM.
On macOS the tool also reads the system’s sandbox violation log store, giving teams real-time alerts when an agent probes a boundary it should not.
Containers solve the same problem with more weight, and they are the usual answer for isolating untrusted code. Anthropic’s bet is that most agent work needs a fence, not a separate house, and that a fence developers will actually switch on beats a container they skip.
