Beyond permission prompts: making Claude Code more secure and autonomous

생각 덩어리

권한 모델의 역설 — approve 연타가 approval fatigue를 만든다

Claude Code runs on a permission-based model: by default, it's read-only, which means it asks for permission before making modifications or running any commands.

Constantly clicking "approve" slows down development cycles and can lead to ‘approval fatigue’, where users might not pay close attention to what they're approving, and in turn making development less safe.

샌드박싱 — 경계를 긋자 프롬프트가 84% 줄었다

Sandboxing creates pre-defined boundaries within which Claude can work more freely, instead of asking for permission for each action.

In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%. By defining set boundaries within which Claude can work freely, they increase security and agency.

두 개의 경계 — 파일시스템 격리와 네트워크 격리

Filesystem isolation, which ensures that Claude can only access or modify specific directories. This is particularly important in preventing a prompt-injected Claude from modifying sensitive system files.

Network isolation, which ensures that Claude can only connect to approved servers. This prevents a prompt-injected Claude from leaking sensitive information or downloading malware.

둘은 한 쌍이다 — 하나가 빠지면 다른 하나도 뚫린다

It is worth noting that effective sandboxing requires both filesystem and network isolation. Without network isolation, a compromised agent could exfiltrate sensitive files like SSH keys; without filesystem isolation, a compromised agent could easily escape the sandbox and gain network access.

샌드박스 bash 툴 — 컨테이너 없이 OS 프리미티브로

We're introducing a new sandbox runtime, available in beta as a research preview, that lets you define exactly which directories and network hosts your agent can access, without the overhead of spinning up and managing a container. This can be used to sandbox arbitrary processes, agents and MCP servers.

We’ve built this on top of OS level primitives such as Linux bubblewrap and MacOS seatbelt to enforce these restrictions at the OS level. They cover not just Claude Code's direct interactions, but also any scripts, programs, or subprocesses that are spawned by the command.

네트워크는 프록시 단일 통로 — unix domain socket

Network isolation, by only allowing internet access through a unix domain socket connected to a proxy server running outside the sandbox. This proxy server enforces restrictions on the domains that a process can connect to, and handles user confirmation for newly requested domains.

And if you’d like further-increased security, we also support customizing this proxy to enforce arbitrary rules on outgoing traffic.

인젝션이 성공해도 격리는 유지된다

Sandboxing ensures that even a successful prompt injection is fully isolated, and cannot impact overall user security. This way, a compromised Claude Code can't steal your SSH keys, or phone home to an attacker's server.

If Claude tries to access something outside of the sandbox, you'll be notified immediately, and can choose whether or not to allow it.

오픈소스 — 다른 에이전트 빌더들도 가져가라

To make it easier for other teams to build safer agents, we have open sourced this feature. We believe that others should consider adopting this technology for their own agents in order to enhance the security posture of their agents.

Claude Code on the web — 자격증명은 샌드박스 밖, git은 프록시 경유

Claude Code on the web executes each Claude Code session in an isolated sandbox where it has full access to its server in a safe and secure way.

We've designed this sandbox to ensure that sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code. This way, even if the code running in the sandbox is compromised, the user is kept safe from further harm.

Claude Code on the web uses a custom proxy service that transparently handles all git interactions. Inside the sandbox, the git client authenticates to this service with a custom-built scoped credential. The proxy verifies this credential and the contents of the git interaction (e.g. ensuring it is only pushing to the configured branch), then attaches the right authentication token before sending the request to GitHub.

(원문 말미 Getting started — Claude Code에서 /sandbox 실행, 웹은 claude.com/code. 직접 에이전트를 만든다면 오픈소스된 샌드박싱 코드를 통합해보라는 권유로 마무리.)