Anthropic on sandboxing agents as their capabilities grow
Summary
Anthropic published an engineering writeup on sandboxing AI agents to limit blast radius, discussing permission scoping techniques.
Similar Articles
@AnthropicAI: New on the Engineering Blog: The access and permissions we grant agents should evolve with their capabilities. In our o…
Anthropic's engineering blog details how they contain Claude agents across products using sandboxing and access controls to cap the blast radius, sharing lessons from deploying Claude Code, Claude Cowork, and claude.ai.
How We Built Secure, Scalable Agent Sandbox Infrastructure (8 minute read)
Browser Use describes two patterns for isolating AI agents that execute code: isolating the tool vs isolating the agent. They implemented the agent isolation pattern using Unikraft micro-VMs on AWS, achieving secure, scalable, and disposable sandboxes.
Shrinking an agent's blast radius: per-session tool allowlist + gVisor sandbox (open source, honest limits)
The article introduces two new security features for the Chimera open-source agent: per-session tool allowlists to restrict tool access and gVisor sandboxing to reduce the host kernel surface, aiming to shrink the agent's blast radius.
Proper security and maintenance for agentic environments
A developer built Terrarium, an open-source sandboxing solution for running multiple AI agents securely with isolated worlds, reverse-proxy management, and state rollback.
Deploy agent in sandbox VS Decoupling
The article compares two patterns for deploying AI agents in the cloud: directly in sandboxes vs decoupling components. It explains the limitations of the sandbox approach due to cloud failures, and highlights Anthropic's Claude Managed Agent as a solution that decouples session store, agent runtime, and sandbox for resilience.