What is Sandbox?
An isolated environment where an agent can run code, install packages, or execute commands without affecting the host system. Docker containers, Firejail, or a separate VM. Essential for agents that auto-execute shell commands.
The idea
A sandbox is a boundary, enforced by the operating system rather than by the model, around what an agent's commands can reach. If the agent is tricked or simply wrong, the damage stops at the boundary. Claude Code's Bash sandbox is a concrete example: it limits which files and which network hosts shell commands and the processes they start can reach.
How Claude Code does it
It runs on macOS, Linux and WSL2, using the built-in Seatbelt framework on macOS and bubblewrap and socat on Linux; on native Windows commands run unsandboxed. It is off by default and you turn it on with /sandbox. By default commands can write to the working directory and a temp directory, and network connections go through a proxy that checks each host against an allowed-domains list that starts empty.
What it does not cover
By default a sandboxed command can still read most of the machine, including credential files such as ~/.ssh and ~/.aws/credentials, unless you deny reads. The sandbox wraps shell commands only: Claude's file tools, MCP servers and hooks run outside it, as do commands you type yourself at the shell prompt. To put everything behind one boundary, run the whole process in a container or virtual machine.
Example
With the sandbox on and no domains allowed, a build script that tries to upload your environment to an unknown host is stopped at the proxy, and a command that tries to write outside the project folder is refused by the operating system.
Sources
See also
← Back to the full AI agent glossary.