secure-deployment-risks changedmanaged-agents/secure-deployment-risks
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+7added
Lines−7removed
From line
21
where the diff opens
First seen
13 Oct 2026
this site's first read of the page
Recorded edits4to this page, all time
The whole hunk
from line 21, old and new numbered
/
from line 21
2121| What can go wrong | Example | Controls |
2222| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
2323| Untrusted input steers the agent | A ticket tells the agent to cancel every open order | [Smallest tool set](https://platform.claude.com/docs/en/managed-agents/secure-deployment#give-the-agent-the-smallest-tool-set), [untrusted input kept away from powerful tools](https://platform.claude.com/docs/en/managed-agents/secure-deployment#keep-untrusted-input-away-from-powerful-tools), [approvals for risky actions](https://platform.claude.com/docs/en/managed-agents/secure-deployment#approve-risky-actions) |
24| Code in the sandbox can use a credential | A script the agent was tricked into running sends the agent's key to an outside host, or uses it to read every customer's orders | [Credentials in vaults](https://platform.claude.com/docs/en/managed-agents/secure-deployment#keep-credentials-in-vaults), [limited networking](https://platform.claude.com/docs/en/managed-agents/secure-deployment#limit-the-network), [approvals for risky actions](https://platform.claude.com/docs/en/managed-agents/secure-deployment#approve-risky-actions) |
24| Code in the sandbox can use a credential | A script the agent was tricked into running sends the agent’s key to an outside host, or uses it to read every customer’s orders | [Credentials in vaults](https://platform.claude.com/docs/en/managed-agents/secure-deployment#keep-credentials-in-vaults), [limited networking](https://platform.claude.com/docs/en/managed-agents/secure-deployment#limit-the-network), [approvals for risky actions](https://platform.claude.com/docs/en/managed-agents/secure-deployment#approve-risky-actions) |
2525| An open network lets data out | A bash command posts a file to an outside host | [Limited networking](https://platform.claude.com/docs/en/managed-agents/secure-deployment#limit-the-network), the [`web_fetch` domain list](https://platform.claude.com/docs/en/managed-agents/secure-deployment#restrict-web-search-and-web-fetch) |
2626| Claude takes a step you did not expect | To get past an obstacle, it uses a tool or credential it can reach | The settings in [Secure your Managed Agents deployment](https://platform.claude.com/docs/en/managed-agents/secure-deployment). An [offline reviewer](https://platform.claude.com/docs/en/managed-agents/secure-deployment-monitoring#optionally-have-an-offline-reviewer-read-every-transcript) can flag the step afterward |
2727
28These settings lower the risk but do not remove it, so do not put data in the sandbox that must never leave it. An agent can still put data it is allowed to read into its own reply or tool output. Limit a key's permissions at the service that issued it, because these settings do not limit them. The settings do not secure your custom tools, your MCP servers, or your self-hosted infrastructure.
28These settings lower the risk but do not remove it, so do not put data in the sandbox that must never leave it. An agent can still put data it is allowed to read into its own reply or tool output. Limit a key’s permissions at the service that issued it, because these settings do not limit them. The settings do not secure your custom tools, your MCP servers, or your self-hosted infrastructure.
2929
3030## What the sandbox can and cannot do
3131
from line 33
3333
3434| Part | Where it runs | What limits it |
3535| ---------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Agent loop | Anthropic's servers | The tool set, permission policies, and budget that you set |
36| Agent loop | Anthropic’s servers | The tool set, permission policies, and budget that you set |
3737| `bash` and file tools | The sandbox. In a cloud environment, each session gets its own isolated Linux container | Environment networking, the tool set, and permission policies |
38| `web_search` and `web_fetch` | Anthropic's servers | The tool's own domain list, your organization's web search and web fetch settings in the Claude Console, and, in a `limited` cloud environment, the environment's allowed hosts. `web_fetch` also opens only URLs that have already appeared in the session |
39| Vault secret | Outside the sandbox. MCP credentials never enter it. For an environment variable credential, code sees a placeholder | For an MCP credential, the MCP server URL it is for. For an environment variable credential, the hosts the credential allows, its injection location, and the environment's allowed hosts |
40| Session history | Anthropic's servers, until you delete the session | The API keys for the workspace, the Developer and Admin roles in the Claude Console, and session deletion |
38| `web_search` and `web_fetch` | Anthropic’s servers | The tool’s own domain list, your organization’s web search and web fetch settings in the Claude Console, and, in a `limited` cloud environment, the environment’s allowed hosts. `web_fetch` also opens only URLs that have already appeared in the session |
39| Vault secret | Outside the sandbox. MCP credentials never enter it. For an environment variable credential, code sees a placeholder | For an MCP credential, the MCP server URL it is for. For an environment variable credential, the hosts the credential allows, its injection location, and the environment’s allowed hosts |
40| Session history | Anthropic’s servers, until you delete the session | The API keys for the workspace, the Developer and Admin roles in the Claude Console, and session deletion |
4141| Custom tools | Your application | Your code |
4242
4343In a cloud environment, sessions do not share filesystem state. A memory store attached to more than one session is shared between them.
4444
45These limits do not replace each other. For example, limiting the environment's hosts does not stop the agent from using a credential on a host you allowed.
45These limits do not replace each other. For example, limiting the environment’s hosts does not stop the agent from using a credential on a host you allowed.
4646
No line in this hunk matches that.