Anthropic Shields Claude Code with Local Sandbox Mode

Anthropic has introduced a local sandbox mode for its Claude Code desktop tool, enhancing security by isolating command execution at the operating system level. This feature is currently available on macOS and Linux/WSL2 platforms.

The sandbox implementation varies by platform: macOS uses Seatbelt, Apple's built-in framework, while Linux and WSL2 users rely on bubblewrap, a lightweight containerization tool. Both approaches restrict filesystem access to the current working directory and its children, with network requests passing through a proxy layer that permits connections only to pre-approved domains.

Windows users are not supported at this time, although Anthropic aims to provide full native support in the future. The sandbox comes with two operational modes: auto-allow, which executes commands without user approval each time, and traditional permissions mode, where every command requires manual verification.

Anthropic has achieved an 84% reduction in permission prompts since iterating on this sandbox approach began around October 2025. This development addresses a growing security concern, prompt injection attacks, by confining execution to the working directory and preventing exfiltration attempts through unauthorized domains.