Beyond permission prompts: making Claude Code more secure and autonomous Oct 20, 2025

I'll check local sources for this Anthropic piece so the paragraphs stay fact-bound and don't invent details.Fetching the Anthropic Engineering post so the write-up stays tied to real product details, not invented figures.**Anthropic** published an **Engineering** post on **Oct 20, 2025** describing how **Claude Code** moves past one-approval-per-action safety. The team introduced two sandbox-backed capabilities: a **sandboxed bash tool** and **Claude Code on the web**. In internal usage, sandboxing cut permission prompts by **84%** while keeping stronger isolation than prompt-by-prompt approvals. The piece is by **David Dworken** and **Oliver Weller-Davies**.

Claude Code’s default model is read-only: it asks before edits and most commands, with narrow auto-allows for safe commands such as **echo** and **cat**. Sandboxing replaces that chatter with fixed OS-level bounds. **Filesystem isolation** limits access and writes to allowed paths (typically the working directory) so a prompt-injected agent cannot rewrite sensitive system files. **Network isolation** forces outbound traffic through a proxy outside the sandbox, so only approved hosts are reachable. Anthropic argues both are required: network-only isolation still risks exfiltration of files like SSH keys; filesystem-only isolation still risks escape paths that restore network access. The bash sandbox sits on **Linux bubblewrap** and **macOS seatbelt**, covering subprocesses as well as direct tool calls, and ships as a beta research preview with an open **sandbox-runtime**. **Claude Code on the web** runs each session in a cloud sandbox that keeps git credentials and signing keys out of the agent environment, routing git through a custom proxy that validates scoped credentials, branch targets, and repo destinations before attaching real tokens.

For engineers, the practical shift is from constant “approve” clicks to a policy you set once. Approval fatigue is called out directly: frequent prompts slow work and train people to click through without reading. With `/sandbox`, Claude can run, test, and iterate inside the boundary without interrupting you, and only escalate when it tries something outside the allowlist. That is the right shape for multi-file edits, test loops, and scripted verification—the cases where interruption cost is highest and a single missed dangerous approve is also most costly.

Competitive context is agent tooling under real repo access. Coding agents that can shell out and edit trees face the same tension: human gates for every command versus unchecked autonomy. Anthropic’s bet is containment over perpetual confirmation, and it open-sourced the runtime so other agent and **MCP** builders can adopt the same filesystem-plus-network pattern instead of inventing weaker in-process checks. Cloud sandboxing with credential separation is a second product line for teams that want agent work off the laptop entirely.

What to do next: enable sandboxing with `/sandbox`, tighten path and domain allowlists to match how you actually work, and treat out-of-bound prompts as the real review surface. If you build agents, inspect **sandbox-runtime** rather than relying only on model-side “safe command” heuristics. On the web path, confirm that your git proxy rules (branch, remote, credential scope) match your release process before you hand long unattended sessions to the agent.