sandbox-runtime
An open-source operating-system-level sandboxing tool for AI agents released by Anthropic. It implements process-level isolation of file and network access using macOS Seatbelt and Linux bubblewrap, without requiring containers.
Timeline (last 90 days)
Anthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code, used to constrain an agent's file and network access without requiring a container.
On macOS, srt invokes Seatbelt (the policy framework behind sandbox-exec) to restrict a process's path access and network connections.
On Linux, srt relies on bubblewrap (bwrap), isolating the file system and network through namespaces.
The objects srt constrains include three categories: agents, MCP servers and CLI tools.
srt addresses high-frequency risks such as privilege escalation caused by agent misoperation or prompt injection, not strongly adversarial multi-tenant isolation.
For developers, srt can be embedded in their own agent frameworks without being tied to Claude Code.
Anthropic had previously open-sourced MCP and pushed it to become a de facto standard, and srt's open posture is consistent with that.
All Facts (7)
The objects srt constrains include three categories: agents, MCP servers and CLI tools.
50%UnverifiedOn macOS, srt invokes Seatbelt (the policy framework behind sandbox-exec) to restrict a process's path access and network connections.
50%UnverifiedOn Linux, srt relies on bubblewrap (bwrap), isolating the file system and network through namespaces.
50%UnverifiedAnthropic had previously open-sourced MCP and pushed it to become a de facto standard, and srt's open posture is consistent with that.
50%Unverifiedsrt addresses high-frequency risks such as privilege escalation caused by agent misoperation or prompt injection, not strongly adversarial multi-tenant isolation.
50%UnverifiedFor developers, srt can be embedded in their own agent frameworks without being tied to Claude Code.
50%UnverifiedAnthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code, used to constrain an agent's file and network access without requiring a container.
50%