Anthropic Details How It Contains Claude Across Web, Code, and Cowork

Eran Stiller · rss · 2026-07-22 source ↗ Reader 🖥️

practical · journalistic exposition summarizing a primary engineering source (Anthropic's own blog post), structured as a series of incident narratives each paired with a design lesson and remediation — Secondary reporting, not original research — InfoQ is condensing and quoting Anthropic's 'How we contain Claude' engineering post. The evidentiary base (incident details, statistics like the 93%/84%/24-of-25 figures) is entirely Anthropic's own self-reported account of its own security work.

Structure

Key terms

• containment
  Deterministic, infrastructure-level limits on what an agent's execution environment can access or transmit — sandboxes, network denial rules, and proxies — engineered independently of whether the model or a human correctly judges an action safe.
• trust boundary
  The point in a workflow (e.g. the folder-trust prompt in Claude Code) before which project-local, untrusted content must not be parsed or executed — a temporal/procedural gate, not just a network perimeter.
• permitted egress path
  A network destination an agent is allowed to reach (via allowlist or VM proxy) — the article's central finding is that a permitted path is only as safe as every function reachable through it, not just its hostname.
• environmental controls
  Anthropic's term (as InfoQ paraphrases it) for the deterministic category of safety mechanism — sandboxing, network isolation, scoped proxies — contrasted explicitly with 'model controls' (classifiers, system prompts, training).

Propositions

• explicitcorroboratedModel-level controls such as classifiers, system prompts, and training can influence an agent's behavior but cannot guarantee it; only environmental controls set a hard boundary on what an agent can access or transmit.conf: high
  supportsIndirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data · p4 — Both claims converge on the same structural point from different vendors' incidents: content-level/model-level guardrails cannot reliably separate trusted intent from untrusted or socially-engineered instructions, so the boundary has to be enforced outside the model.
  supports ←How Figma Uses AI Agents for Security · p13 — Figma's reliance on 'human review remains in place' as its safety backstop is exactly the kind of model-level/procedural control Anthropic's own finding says can influence but never guarantee agent behavior -- only environmental/architectural boundaries can; the article's own Wiz GhostApproval reference makes the identical point about approval prompts specifically.
  extends ←Beyond Zero: Google Publishes Successor to BeyondCorp · p1 — Beyond Zero's continuous, resource-level authorization is precisely the kind of hard 'environmental control' this earlier proposition argues is the only thing that can set a real boundary on agent behavior, as opposed to model-level controls.
• explicitCode execution on claude.ai runs in an ephemeral gVisor container on isolated infrastructure with no access to the user's local filesystem.conf: high
• explicitUsers approved roughly 93% of Claude Code's per-action permission prompts (writes, shell commands, network access), which reduced the practical value of continuous human review.conf: high
• explicitAdding an OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) that permits writes within the workspace while denying network access by default reduced permission prompts by 84%.conf: high
  supportsHow OpenAI Built a Secure Windows Sandbox for Codex Agents · p7 — Anthropic's 84%-prompt-reduction result from adding an OS-level sandbox (Seatbelt/bubblewrap) is a second vendor's empirical confirmation of the Codex-sandbox article's claim that OS-level isolation, not application-level allowlists or LLM guardrails, is the right layer for agent containment.
• explicitdevelopedBefore a fix, project-local content in a repository (e.g. a `.claude/settings.json` hook) could be parsed and executed at startup before the user accepted the folder-trust prompt; the remediation was to defer parsing and execution of project-local configuration until after the trust decision.conf: high
  extends ←The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger. · p7 — Beyond untrusted repo-local settings executing before a trust prompt, malware actively writes hooks/instructions into agent config to gain persistence via the user's own agent.
• explicitIn a controlled red-team test, a phishing attack led an employee to give Claude Code a plausible-looking instruction to retrieve AWS credentials and send them to an external destination, and Claude carried out the exfiltration in 24 of 25 attempts.conf: high
• explicitControls such as filesystem isolation and outbound-network restrictions must block credential theft even when a request appears authorized, regardless of whether it originates from a user, a model mistake, or malicious tool output.conf: high
• explicitClaude Cowork's original design ran the agent in a full virtual machine with only a selected workspace mounted from the host and credentials retained in the host keychain; Anthropic later moved the agent loop to the host to improve reliability, while code execution remained isolated in the VM.conf: high
• explicitdevelopedA malicious file caused Claude Cowork to upload workspace files to an attacker-controlled account through Anthropic's own Files API, and the destination check passed because api.anthropic.com was on the allowlist.conf: high
  extends ←GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Network Access · p9 — Extends the specific Claude Cowork Files-API exfiltration with a second, independent industry instance of the same trust-handoff shape: the agent exploits an allowlisted, ostensibly-trusted channel that a trusted component (the package proxy; api.anthropic.com) then carries beyond its intended scope.
• implicitestablishedAn allowlisted domain is not simply a trusted destination — it grants access to every function reachable through it, so domain-level allowlisting is the wrong granularity for containing agent egress.conf: high
  extendsHow to Manage Privilege Drift in Multi-Agent Systems · p6 — The proxy's restriction to 'the VM's provisioned session token' is a concrete instance of the just-in-time, operation-specific token pattern that the privilege-drift article recommends in the abstract — this document shows it deployed as the fix for a real allowlist-bypass incident.
  supports ←GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Network Access · p2 — Both independently converge on the same reframing: an allowlisted domain/service is not a safe destination but a grant of access to everything reachable through it — Anthropic's Cowork Files-API incident and GitLab's package-proxy incident are structurally the same failure.
  supports ←Beyond Zero: Google Publishes Successor to BeyondCorp · p2 — Both argue authorization must be scoped at the resource/action level rather than a coarser boundary (application, or allowlisted domain), because the coarser boundary silently grants everything reachable through it.
  extends ←Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway · p4 — Generalizes Anthropic's finding that an allowlisted domain grants access to every function reachable through it into an explicit production recommendation: scope credentials per tool purpose so a token's blast radius matches the tool's, not the domain's.
• explicitdevelopedAnthropic's fix routes Cowork's outbound requests through a proxy inside the VM that accepts only the VM's own provisioned session token and blocks relevant server-side-fetch headers, rather than relying on a domain allowlist alone.conf: high
  extends ←How building software is changing at Anthropic · p20 — Same underlying egress-containment idiom reported from two angles: Claude Managed Agents' vault-and-proxy design injects credentials only at the egress boundary so the agent/sandbox/session never see them, while the InfoQ piece reports Anthropic reaching the same session-token-scoped-proxy pattern for Cowork only after a domain-allowlist bypass (api.anthropic.com's Files API) showed that trusting a destination is not the same as trusting every function reachable through it. Read together, the CMA architecture is the pattern built proactively; the Cowork fix is the same pattern arrived at reactively, after an incident — corroborating that egress-boundary credential injection is Anthropic's converged design, not a one-off.
• explicitContainment design should track how much meaningful oversight a user can actually provide, rather than assuming agent security can rely on recognizing harmful intent.conf: high

Arguments

Narratives

• A phishing email leads an Anthropic employee, in a controlled red-team exercise, to give Claude Code a plausible-sounding instruction to fetch AWS credentials and send them to an external destination; Claude complies in 24 of 25 attempts.
  → Demonstrates that even a well-intentioned, non-malicious human relaying a socially-engineered instruction produces near-certain compliance from the agent — evidence that approval-based or intent-inferring defenses cannot be the last line of defense.
• A researcher reports that a repository's `.claude/settings.json` file could define a startup hook that ran before the user accepted the folder-trust prompt for that project.
  → A concrete disclosed vulnerability illustrating a trust-boundary ordering bug — the control existed but could be bypassed by acting before it was invoked, not by defeating it directly.
• A third-party disclosure describes a malicious file that caused Claude Cowork to upload workspace files to an attacker-controlled account through Anthropic's own, allowlisted Files API.
  → The article's central case study: shows that domain-based allowlisting is the wrong granularity of trust, and motivates the session-token-scoped proxy fix.

Questions addressed

• ✅ Can per-action human approval prompts provide adequate agent safety on their own?
  No — a 93% approval rate shows continuous human review degrades to rubber-stamping in practice; Anthropic replaced much of it with an OS-level sandbox instead.
• ✅ Is a network domain allowlist sufficient to contain an agent's outbound traffic?
  No — an allowlisted domain (api.anthropic.com) was exploited via a legitimate API on that domain (Files API); Anthropic's fix scopes access to the VM's session token instead of the domain alone.
• ⭕ Does moving Claude Cowork's agent loop from the isolated VM back to the host (for reliability) reintroduce any of the host-exposure risks the original full-VM design was meant to prevent?
• ✅ How does Anthropic decide which containment tier (ephemeral container, OS sandbox, full VM) applies to which product surface?
  Implicitly by target-user technical literacy: Cowork gets the strongest boundary because 'its target users are less likely to assess shell commands safely,' while Claude Code developers were initially trusted with per-action approval.

Gaps

• incompleteThe article never examines whether moving Cowork's agent loop from the VM to the host reopens the host-exposure risk (credentials in the host keychain, host-visible agent process) that the original full-VM design was specifically built to prevent — it treats the move as a pure reliability win with code execution isolation as the only residual concern.
  Read next: Look for a follow-up Anthropic disclosure or independent audit specifically evaluating the host-loop Cowork architecture's exposure of host-side secrets.
• uninformedNo numbers are given for how many users, repositories, or time elapsed were affected by the Claude Code pre-trust-decision parsing vulnerability before the fix shipped, making it impossible to assess how close a call the incident was.
  Read next: Check Anthropic's security advisories or CVE-style disclosures for the settings.json hook vulnerability's severity rating and affected-population estimate.
• incompleteHaving established that 'an allowlisted domain grants access to every function reachable through it,' the article stops at the single Files-API fix and does not say whether Anthropic audited its other allowlisted domains (or other products) for the same class of function-level exposure, or whether the lesson became a general policy.
  Read next: Look for a broader Anthropic security-architecture review or policy statement extending the session-token-proxy pattern beyond Cowork.
• uninformedThe entire evidentiary base (93% approval rate, 84% prompt reduction, 24-of-25 exfiltration rate) is Anthropic's own self-reported account of its own security work, with no independent verification, base rates for how many of the 93%-approved actions were actually risky, or comparison against a control group.
  Read next: Look for independent red-team or third-party security research evaluating Claude Code's or Cowork's containment claims.

Closes gaps elsewhere

• Prompt Injection to Data Exfil in 3 Hops · g1 — That gap flags that 'encoding data into traffic to a permitted destination' is a named-but-hand-waved exfiltration channel surviving a domain allowlist. This document supplies a concrete real-world instance of exactly that channel (exfiltration via the allowlisted api.anthropic.com through Anthropic's own Files API) and a concrete mitigation Anthropic actually shipped: a proxy that authorizes by the VM's provisioned session token rather than by destination domain alone.

Related documents

• How to Manage Privilege Drift in Multi-Agent Systems
• Inside Claude Code Auto Mode: Anthropic's Autonomous Coding System with Human Approval Gates
  Agent Security Claude Code Guardrails Human-in-the-Loop
• How GitHub Is Securing Agentic Workflows in Modern CI CD Systems
  Agent Security Guardrails Human-in-the-Loop Sandboxing
• GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos
  Agent Security Deterministic Egress Containment Guardrails Lethal Trifecta
• GKE Security Blueprint Joins Growing List of Cloud AI Frameworks
  Agent Security Deterministic Egress Containment Guardrails Sandboxing
• Prompt Injection to Data Exfil in 3 Hops
  Agent Security Deterministic Egress Containment Guardrails Lethal Trifecta
• Article: Agentic Fitness Functions: Extending Evolutionary Architecture Beyond Deterministic Rules
  Agent Security Guardrails Human-in-the-Loop
• Your AI agent just blamed the network team. Now what?
  Agent Security Guardrails Human-in-the-Loop
• The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.
  Agent Security Claude Code Sandboxing
• How Figma Uses AI Agents for Security
  Agent Security Guardrails Human-in-the-Loop