Anthropic's Claude Code Sandbox October 24, 2026

Anthropic released its internal sandbox engine behind Claude Code as an open-source project named sandbox-runtime, published under the Apache-2.0 license as the @anthropic-ai/sandbox-runtime package on npm. According to aiweekly.co's report, the utility, abbreviated as srt, provides lightweight operating-system-level filesystem and network restriction enforcement for arbitrary local processes without spinning up traditional virtual machines or OCI containers. The software packages Anthropic's native isolation mechanisms across macOS, Linux, and Windows, exposing the exact operational boundary Claude Code uses to execute agent tasks securely.

This breakdown details the architecture, configuration mechanisms, cross-platform primitives, and known security limitations of the standalone sandbox-runtime project. The release is structured for software engineers, systems architects, security auditors, and AI developers building autonomous coding assistants or hosting untrusted Model Context Protocol servers. Readers will find comprehensive setup instructions, native command examples, platform support matrices, and an analysis of how Anthropic enforces allow-only network egress and credential hygiene.

What shipped in Anthropic's Claude Code Sandbox October 24

The initial open-source release packages the standalone srt command-line binary alongside the core @anthropic-ai/sandbox-runtime library directly on the public npm registry under Apache-2.0 terms. Rather than virtualizing system hardware or relying on container daemons like Docker or Podman, the runtime hooks directly into OS security APIs to constrain child processes. On macOS hosts, the system invokes the sandbox-exec utility paired with dynamically generated Seatbelt configuration profiles. On Linux distributions, srt wraps the bubblewrap utility to enforce isolated network namespaces and mount boundaries without root privileges.

For Windows operating systems, Anthropic shipped an alpha backend that combines Windows Filtering Platform network egress filters, write-restricted tokens, and explicit NTFS access control lists. The Windows package bundles a specialized srt-win.exe helper executable compiled for both x64 and arm64 architectures. Installing the Windows runtime requires an elevated one-time setup command that provisions a dedicated local user account titled srt-sandbox alongside a system-wide filter set, establishing the process boundary needed to constrain untrusted local process execution.

What improved in Anthropic's Claude Code Sandbox October 24

The standalone distribution transitions Anthropic's internal agent execution harness into a modular, publicly inspectable framework that developers can bind to arbitrary local workloads. Prior implementations of Claude Code contained sandbox logic internally within the client application, whereas the standalone srt package exposes modular policy files, explicit socket rules, and direct command-line execution flags to any local script or development tool. Developers can now isolate individual developer CLI tools without paying the startup latency, memory overhead, or virtualization footprint associated with standard container runtimes.

The release also introduces fine-grained credential masking and network control primitives designed specifically for autonomous agent runs. The runtime automatically intercepts environment variables and designated credential files, preventing untrusted processes from exfiltrating sensitive tokens even if a tool requests broad disk visibility. Furthermore, the engine embeds AWS Signature Version 4 request signing, enabling sandboxed processes to authenticate outward cloud API requests with masked keys that never expose raw access secrets to the executing code.

What you gain from Anthropic's Claude Code Sandbox October 24

Engineering teams gain a drop-in security mechanism to constrain third-party Model Context Protocol servers and unverified language model tools. By altering a single configuration key in a project .mcp.json manifest, teams can wrap any MCP server process inside srt boundaries rather than spawning unconstrained Node.js or Python child processes. The runtime enforces allow-only outbound network communication with explicit wildcard domain support, ensuring that malicious tool outputs or hallucinated terminal commands cannot establish unauthorized command-and-control sockets or read arbitrary parent directories.

In addition to broad file and domain controls, operators gain fine-grained local Unix-socket allowlisting and experimental TLS termination capabilities. The socket filter allows selective bridging to specific background IPC endpoints while blocking general inter-process communication across the host. For organizations auditing automated web traffic, the built-in TLS inspection engine terminates outbound HTTPS connections directly within the sandbox boundary, giving administrators deep visibility into network payloads before they exit the local development workstation.

How to get Anthropic's Claude Code Sandbox October 24

Developers can install the sandbox runtime globally from the npm package repository using standard Node.js package management commands. On Linux and macOS systems, running the package install immediately registers the srt command line utility:

npm install -g @anthropic-ai/sandbox-runtime

On Windows workstations, the installation requires an initial elevated administrative shell to create the local service account and configure the Windows Filtering Platform rules:

srt windows-install

To sandbox an existing Model Context Protocol server, open the project .mcp.json configuration file and swap the primary execution target from standard Node tools to the srt binary:

{
  "mcpServers": {
    "filesystem": {
      "command": "srt",
      "args": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/workspace"]
    }
  }
}

Teams integrating the tool inside Claude Code environments can confirm their installation and verify execution status through the core CLI:

claude update
srt --version

What to watch after Anthropic's Claude Code Sandbox October 24

Anthropic explicitly designated this initial release as a research preview intended to foster safer AI agent development, warning early adopters that both configuration schemas and programmatic APIs remain subject to breaking changes. Development teams must evaluate specific security limitations on Windows hosts before treating the sandbox as an impenetrable barrier. The Windows backend relies on the Windows Filtering Platform, which does not intercept network calls made through Windows operating system services like Windows Update.

Additionally, the Windows implementation cannot constrain applications built on the native Windows Schannel TLS stack. Standard Windows binaries including System32\curl.exe, PowerShell's Invoke-WebRequest cmdlet, .NET HttpClient consumers, and the winget package manager completely bypass the egress fence on Windows systems. Organizations deploying the sandbox on Windows workstations must restrict agent tasks from invoking Schannel-backed binaries until Anthropic resolves these system-level filter gaps in subsequent updates.