Editorial illustration for Anthropic sandbox-runtime OS-level isolates AI agents, denies network access
Anthropic Releases Sandbox-Runtime for AI Agent Isolation
Anthropic sandbox-runtime OS-level isolates AI agents, denies network access
Anthropic published sandbox-runtime, the same OS-level isolation layer that runs Claude Code's sandboxed bash tool, as a standalone open-source package. The npm package, @anthropic-ai/sandbox-runtime, sits at version 0.0.81, weighs about 11.4 MB unpacked, and ships under an Apache-2.0 license. It needs Node.js 22.12 or newer.
Install it globally and prefix any command with srt, and that process gets walled off from most of the filesystem and network by default. No Docker, no container runtime, no virtual machine. On macOS, srt leans on sandbox-exec and generates Seatbelt profiles on the fly.
On Linux, it uses bubblewrap with the network namespace stripped out, plus socat and ripgrep as dependencies. Windows support exists but is still alpha.
The tool isn't locked to Claude Code either. Anthropic built it so local MCP servers, custom agents, or ordinary command-line programs can run inside the same restrictions. Anthropic says internal use of this sandboxing cut permission prompts in Claude Code by 84%, a self-reported figure tied to running agent processes with tighter file and network boundaries across the whole process tree.
The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code.
Why this matters
A tool like sandbox-runtime matters because the whole pitch of agentic coding tools rests on a premise most teams haven't stress-tested: letting an LLM run shell commands on your machine. Anthropic built srt for its own sandboxed bash tool in Claude Code, then released it as a standalone npm package, which tells us the company sees isolation as infrastructure, not a feature bolted onto one product. The design choice to skip containers and work at the OS level is the interesting part for us.
It's lighter than Docker, which means more teams will actually turn it on instead of skipping isolation because setup is annoying. The network-deny-by-default stance, where access requires an explicit allowlist, is the right default for anyone wiring agents into MCP servers or giving them command-line access. At v0.0.81, this is early and clearly still hardening.
If you're building agents that touch real file systems or call out to the internet, this is worth testing now, before you ship something that can wander further than you intended.
Related Reading
Browse all Anthropic news →
Market Trends AI drives three initiatives to accelerate global action for planet protection
Market Trends Akamai data shows AI training bots and content‑fetching bots rise since July
Market Trends NVIDIA and Google Cloud let developers scale AI from prototype to production
Related Topic Claude gains shared context in Excel, PowerPoint; Microsoft adds Copilot Cowork
AI Tools & Apps
Related Topic Anthropic: Hackers Stole Claude Tokens Via Compromised Session Key
LLMs & Generative AI
From Archives AMD Says Server CPUs Are a USD 200 Billion Market as It Announces Helion Blueprint
From Archives Meta to create new share class to fund significant AI investment
From Archives Kimi K3.1 Pro tops OfficeQA Pro v2, closing in on Anthropic's Claude Opus 5.5.
LLMs & Generative AI
From Archives Anthropic Says Unreleased Model Outperforms Mythos 5.1 in Capability, Alignment
Open Source
Common Questions Answered
What is Anthropic's sandbox-runtime and how does it isolate AI agents?
Anthropic's sandbox-runtime is an OS-level isolation layer released as an open-source npm package (@anthropic-ai/sandbox-runtime) that restricts which files a process can access and which network hosts it can reach. It operates without requiring Docker or container runtimes, instead using OS-level sandboxing to wall off processes from the filesystem and network by default.
What are the technical requirements and specifications for installing sandbox-runtime?
The sandbox-runtime npm package is available at version 0.0.81, weighs approximately 11.4 MB unpacked, and is distributed under an Apache-2.0 license. It requires Node.js 22.12 or newer to function, and can be installed globally with commands prefixed by 'srt' to enable the sandboxing isolation.
Why did Anthropic release sandbox-runtime as a standalone package instead of keeping it proprietary to Claude Code?
Anthropic released sandbox-runtime as a standalone package because the company views isolation as critical infrastructure rather than a feature tied to a single product. This decision reflects the company's recognition that agentic coding tools require robust sandboxing solutions, and by open-sourcing it, Anthropic is enabling broader adoption of secure AI agent execution across different teams and applications.
What is the key advantage of sandbox-runtime's OS-level approach compared to container-based sandboxing?
Sandbox-runtime's OS-level sandboxing approach eliminates the need for Docker or container runtimes, making it lighter weight and more efficient than traditional containerization. This design choice allows processes to be isolated directly at the operating system level while maintaining fine-grained control over file and network access without the overhead of spinning up full containers.
What security concern does sandbox-runtime address for teams using agentic coding tools?
Sandbox-runtime addresses the critical security challenge of letting language models run shell commands directly on machines, which most teams haven't thoroughly tested or secured. By providing OS-level isolation that denies network access and restricts filesystem permissions by default, it creates a safer execution environment for AI agents to operate without risking unauthorized access to sensitive files or network resources.
Further Reading
- GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Trusted Connections - InfoQ
- Managing the Cyber Risk of Agentic AI - UK National Cyber Security Centre
- Managing the Cyber Risk of Agentic AI - UK National Cyber Security Centre
- Agent Compute Engine Deep Dive - Google Cloud Blog
- Cybersecurity Recommendations for Securing AI Agents - ISACA
