- Anthropic open-sourced sandbox-runtime (srt), the OS-level sandbox that powers Claude Code, as the @anthropic-ai/sandbox-runtime npm package under an Apache 2.0 license.
- The tool restricts filesystem and network access for agents, MCP servers, and CLI tools without requiring a container.
- It uses Seatbelt profiles on macOS and bubblewrap on Linux, with an alpha Windows build backed by Windows Filtering Platform filters and NTFS ACLs.
- Anthropic describes the release as a research preview meant to help other developers build more secure agentic systems.
What Happened
Anthropic released sandbox-runtime, the OS-level sandboxing tool that restricts an AI agent’s filesystem and network access without needing a container, as an open-source npm package under Apache 2.0. MarkTechPost covered the release on Oct. 24, 2026.
Why It Matters
The release follows weeks of scrutiny over how well AI labs contain their own agents: CrowdStrike recently found criminal hackers routinely bypassing AI model guardrails, and Anthropic has separately been expanding dedicated security work through its Cyber Mission for critical infrastructure. Open-sourcing the exact sandbox used for Claude Code gives outside developers the same containment tooling Anthropic relies on internally.
Technical Details
sandbox-runtime enforces an allow-only network policy with wildcard domain support and Unix-socket allowlisting, and includes experimental TLS termination for inspecting HTTPS traffic, credential masking for environment variables and files, and AWS SigV4 request signing with masked keys. It runs via sandbox-exec with Seatbelt profiles on macOS and bubblewrap on Linux, with an alpha Windows build using Windows Filtering Platform filters and NTFS ACLs. Developers install it with npm install -g @anthropic-ai/sandbox-runtime and prefix commands with srt, or use it as a TypeScript library.
Who’s Affected
Developers building agentic coding tools, MCP servers, or CLI-based AI workflows get direct access to the same sandboxing layer Claude Code already uses in production. Anthropic frames the release as an early preview rather than a finished product.
What’s Next
Anthropic says sandbox-runtime remains a research preview, and it’s inviting the broader developer ecosystem to test and build on it as agentic coding tools become more widely deployed.
