Securely deploying AI agents changedagent-sdk/secure-deployment
Nearest release: v2.1.291, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Oct 2026 03:21 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+24added
Lines−24removed
From line
59
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 59, old and new numbered
/
from line 59
5959
6060Different isolation technologies offer different tradeoffs between security strength, performance, and operational complexity.
6161
62<Info>
63 In all of these configurations, Claude Code (or your Agent SDK application) runs inside the isolation boundary (the sandbox, container, or VM). The security controls described below restrict what the agent can access from within that boundary.
64</Info>
62> [!NOTE]
63>
64> In all of these configurations, Claude Code (or your Agent SDK application) runs inside the isolation boundary (the sandbox, container, or VM). The security controls described below restrict what the agent can access from within that boundary.
6565
6666| Technology | Isolation strength | Performance overhead | Complexity |
6767| - | - | - | - |
from line 277
277277
278278Note that not all programs respect `HTTP_PROXY`/`HTTPS_PROXY`. Most tools (curl, pip, npm, git) do, but some may bypass these variables and connect directly. For example, Node.js `fetch()` ignores these variables by default; in Node 24+ you can set `NODE_USE_ENV_PROXY=1` to enable support. To cover tools that ignore these variables, you can use [proxychains](https://github.com/haad/proxychains) to intercept network calls, or configure iptables to redirect outbound traffic to a transparent proxy.
279279
280<Info>
281 A **transparent proxy** intercepts traffic at the network level, so the client doesn't need to be configured to use it. Regular proxies require clients to explicitly connect and speak HTTP CONNECT or SOCKS. Transparent proxies (like Squid or mitmproxy in transparent mode) can handle raw redirected TCP connections.
282</Info>
280> [!NOTE]
281>
282> A **transparent proxy** intercepts traffic at the network level, so the client doesn't need to be configured to use it. Regular proxies require clients to explicitly connect and speak HTTP CONNECT or SOCKS. Transparent proxies (like Squid or mitmproxy in transparent mode) can handle raw redirected TCP connections.
283283
284284Both approaches still require the TLS-terminating proxy and trusted CA certificate. They just ensure traffic actually reaches the proxy.
285285
from line 295
295295docker run -v /path/to/code:/workspace:ro agent-image
296296```
297297
298<Warning>
299 Even read-only access to a code directory can expose credentials. Common files to exclude or sanitize before mounting:
300
301 | File | Risk |
302 | - | - |
303 | `.env`, `.env.local` | API keys, database passwords, secrets |
304 | `~/.git-credentials` | Git passwords/tokens in plaintext |
305 | `~/.aws/credentials` | AWS access keys |
306 | `~/.config/gcloud/application_default_credentials.json` | Google Cloud ADC tokens |
307 | `~/.azure/` | Azure CLI credentials |
308 | `~/.docker/config.json` | Docker registry auth tokens |
309 | `~/.kube/config` | Kubernetes cluster credentials |
310 | `.npmrc`, `.pypirc` | Package registry tokens |
311 | `*-service-account.json` | GCP service account keys |
312 | `*.pem`, `*.key` | Private keys |
313
314 Consider copying only the source files needed, or using `.dockerignore`-style filtering.
315</Warning>
298> [!WARNING]
299>
300> Even read-only access to a code directory can expose credentials. Common files to exclude or sanitize before mounting:
301>
302> | File | Risk |
303> | - | - |
304> | `.env`, `.env.local` | API keys, database passwords, secrets |
305> | `~/.git-credentials` | Git passwords/tokens in plaintext |
306> | `~/.aws/credentials` | AWS access keys |
307> | `~/.config/gcloud/application_default_credentials.json` | Google Cloud ADC tokens |
308> | `~/.azure/` | Azure CLI credentials |
309> | `~/.docker/config.json` | Docker registry auth tokens |
310> | `~/.kube/config` | Kubernetes cluster credentials |
311> | `.npmrc`, `.pypirc` | Package registry tokens |
312> | `*-service-account.json` | GCP service account keys |
313> | `*.pem`, `*.key` | Private keys |
314>
315> Consider copying only the source files needed, or using `.dockerignore`-style filtering.
316316
317317### Writable locations
318318
No line in this hunk matches that.