Anthropic Sandbox Runtime

Executive Summary

Anthropic Sandbox Runtime (srt) is Anthropic's open-source isolation layer for local processes, distributed as a TypeScript library and CLI. It underpins Claude Code's sandboxed shell tool and can wrap other agents or commands. Anthropic's October 2025 launch report attributed an 84% reduction in permission prompts to its internal use of sandboxing; that is a vendor result, not a benchmark reproduced for this review.^[1][2]

The September refresh changes the practical assessment. The repository now lives under anthropics, while retaining its Beta Research Preview label. Release v0.0.76 documents Windows alpha support, allowRead paths, experimental TLS termination, and additional network address checks. Several earlier reasons to reject srt are therefore obsolete, although its platform differences and security qualifications remain substantial.^[1][3][4]

See the local agent sandboxes comparison for the wider category.

---

Product Overview

The standalone package installs with npm install -g @anthropic-ai/sandbox-runtime; srt wraps a command and reads policy from ~/.srt-settings.json or an explicit settings path. The library exposes SandboxManager for embedders. Claude Code provides its own /sandbox interface, approval behavior, credential settings, and managed configuration on top of the runtime.^[3][6]

The standalone Windows implementation should not be read as a promise that Claude Code's native Windows sandbox is available. The two sources describe different product surfaces.^[3][6]

A concrete local policy

For a macOS or Linux project, first install the runtime and the dependencies listed below. Save this example as ~/.config/srt/project.json, outside the writable project, creating the directory if needed:^[3]

{
  "filesystem": {
    "denyRead": ["~", "./.env", "./secrets"],
    "allowRead": ["."],
    "allowWrite": ["."],
    "denyWrite": ["./.git"]
  },
  "network": {
    "allowedDomains": [],
    "deniedDomains": []
  }
}

From the project directory, run an existing test command through that policy:

npm install -g @anthropic-ai/sandbox-runtime
srt --settings "$HOME/.config/srt/project.json" npm test

The policy re-allows the current project inside an otherwise denied home directory, keeps the named project secrets unreadable, permits project writes except .git, and grants no outbound destinations. It is a starting configuration, not a complete secret inventory: environment variables, other readable system locations, and separately granted paths still need review. Tests that need a home-installed toolchain, external cache, or registry will require deliberate, narrow exceptions. This example was checked against v0.0.76 documentation; it was not executed for this report.^[3][6]

Embedding and troubleshooting

A library integration supplies a SandboxRuntimeConfig, calls SandboxManager.initialize(), wraps the intended command with wrapWithSandbox(), executes the returned command, and calls reset() when work finishes. Initialization establishes shared proxy and platform state; wrapping a string alone is not process execution. An embedding application remains responsible for process completion, cleanup, cancellation, and the authority of other tools it exposes.^[3]

Use srt --debug when diagnosing a denied command. For concurrent library calls, the current API accepts an opaque per-invocation commandId for violation attribution, plus commandText when the executed wrapper differs from the user's command. This avoids confusing repeated or common-prefix commands in violation reports; it does not change their permissions.^[3]

---

Technical Architecture

On macOS and Linux, reads are allowed by default. A broad denyRead can be narrowed with allowRead; more-specific denied paths remain protected according to the documented precedence. Writes and network access use explicit allow rules. Policies apply to the wrapped process tree, rather than relying on the model to obey instructions.^[3]

HTTP and SOCKS5 proxies mediate network access. New resolved-address checks reject allowed hostnames that resolve to certain local or metadata addresses, with explicit exceptions and configurable denied ranges. Those checks do not apply when an upstream proxy performs the connection; private network ranges are not universally blocked by default.^[4][3]

Experimental network.tlsTerminate can decrypt HTTPS at the runtime proxy. In Claude Code, it enables opt-in credential masking and substitution. It does not automatically add content filtering, and TLS exclusions bypass substitution for the excluded hosts. Treat these as configurable controls, not a general data-loss-prevention guarantee.^[3][6]

---

Strengths

• Reusable first-party implementation. Anthropic publishes the runtime behind its own agent integration under a permissive license.^[2][5]
• More expressive policy than the June snapshot. Read re-allow rules, TLS termination, and resolved-address checks close previously identified feature gaps.^[3][4]
• Visible security maintenance. PR #316, merged June 22, 2026, corrected macOS egress enforcement when allowLocalBinding was enabled, closing issue #88. The old report should not describe that specific defect as still open.^[7][8]

---

Cautions

• Policy determines exposure. Claude Code has no built-in credential deny list. Secret files and inherited environment variables need explicit deny or mask settings. Masking and file support differ by platform.^[6]
• TLS remains opaque by default. Broad allowed domains can still carry unwanted data. The documentation warns about domain fronting and recommends additional inspection where the threat model requires it.^[6]
• Exceptions can remove the boundary. Apple Events support permits launching applications outside the sandbox; Docker socket access and broad writable executable paths can also undermine isolation. The weaker nested Linux mode is explicitly less secure.^[6]
• Windows is alpha. Per-user tool installations may be inaccessible, some TLS clients have certificate-revocation compatibility problems, and system-resolver DNS requests are not fenced by the sandbox account's network rules. Per-command filesystem grants also differ from session grants.^[3]
• An agent session is broader than its shell. Claude Code's Read, Edit, and Write tools use its permission system; desktop computer use is outside the shell sandbox. Unsandboxed retries and configured exclusions require separate review.^[6]

---

What Developers Say

On February 25, 2026, Hacker News user neop1x described using the runtime through a Pi extension, submitting fixes without a response, and continuing with patched forks. This is a specific historical integration experience, not evidence of September maintainer responsiveness or a representative satisfaction score.^[9]

The January DNS report is another useful first-hand record: its reproduction enabled local binding, and the linked June fix changed the relevant Seatbelt rule and added regression coverage. Keeping both the report and its resolution gives a more accurate picture than repeating the original vulnerability alone. This review did not independently reproduce the exploit or audit the fix.^[8][7]

---

Pricing & Licensing

The runtime is free software under Apache-2.0; using it does not include an agent subscription or model inference. Its license disclaims warranties. Deployment, policy maintenance, and compatibility testing remain the operator's work.^[5]

---

Competitive Positioning

Evaluate srt first when a CLI/library integration and Claude Code compatibility matter. The June profile's claim that read allowlists require a fork is no longer accurate, and its blanket native-Windows exclusion now needs the standalone-versus-Claude distinction.^[3][6]

For a selection exercise, compare your actual policy and platform requirements with nono, Fence, and yolobox. This review does not establish a universal winner or independently test their relative resistance to hostile code.

---

Ideal Customer Profile

Best fit: developers embedding process restrictions into a local agent or using Claude Code's documented sandbox controls, with time to configure credentials and exceptions.^[2][6]

Poor fit: deployments requiring a stable sandbox API or a complete hostile-code isolation guarantee. The runtime remains a research preview, and Claude Code explicitly qualifies its isolation boundary.^[3][6]

---

Viability Assessment

The September release and repository activity establish ongoing development, including fixes and a new platform implementation. They do not establish support response times, adoption in production, or independent security assurance. The move to the main Anthropic organization is useful provenance; it does not remove the preview label.^[1][4][3]

---

Bottom Line

srt is a stronger candidate than the June profile suggested: several stated gaps have been addressed. The decision still depends on which surface you deploy, which permissions you grant, and whether a process sandbox meets your threat model. Start with the documented restrictions and test your own toolchain before relying on broader claims.

Recommended for: local agent and CLI integrations that benefit from configurable OS enforcement.

Not recommended for: treating default settings or a sandbox label as proof that secrets cannot escape.

Outlook: watch platform maturity and security fixes; judge the standalone runtime and Claude Code integration separately.

---

Research by Ry Walker • methodology