Securely deploying AI agents changedagent-sdk/secure-deployment
Nearest release: v2.1.318, published 20 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 4 Nov 2026 18:12 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 4 Nov 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+15added
Lines−13removed
From line
18
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits10to this page, all time
The whole hunk
from line 18, old and new numbered
/
from line 18
1818
1919Claude Code includes several security features that address common concerns. See the [security documentation](https://code.claude.com/docs/en/security.md) for full details.
2020
21* **Permissions system**: Every tool and bash command can be configured to allow, block, or prompt the user for approval. Use glob patterns to create rules like "allow all npm commands" or "block any command with sudo". Organizations can set policies that apply across all users. See [permissions](https://code.claude.com/docs/en/permissions.md).
22* **Command parsing for permissions**: Before executing bash commands, Claude Code parses them into an AST and matches the result against your permission rules. Commands that cannot be parsed cleanly, or that do not match an allow rule, require explicit approval. A small set of constructs such as `eval` always require approval regardless of allow rules. This is a permission gate, not a sandbox; apart from built-in safety checks such as the [critical-path check](https://code.claude.com/docs/en/permission-modes.md#critical-paths) on `rm` and `rmdir` and the [protected paths](https://code.claude.com/docs/en/permission-modes.md#protected-paths) list, it does not infer whether a command is dangerous from its target path or effects.
21* **Permissions system**: Permission rules decide whether a tool call runs, is blocked, or asks for approval first. For the forms a Bash rule misses and how rules combine with permission modes, see [What a Bash rule doesn't match](https://code.claude.com/docs/en/permissions.md#bash-rule-limits) and [Configure permissions](https://code.claude.com/docs/en/agent-sdk/permissions.md). Administrators can also set rules in [managed settings](https://code.claude.com/docs/en/permissions.md#managed-settings).
22* **Critical-path removals**: With the permission mode set to `default`, an `rm` or `rmdir` command recognized as removing your working directory or another [critical path](https://code.claude.com/docs/en/permission-modes.md#critical-paths) needs approval. A matching allow rule doesn't skip that approval. This is a permission gate, not a sandbox. To control what the agent can write, use [filesystem controls](#filesystem-configuration).
2323* **Web search summarization**: Search results are summarized rather than passing raw content directly into the context, reducing the risk of prompt injection from malicious web content.
2424* **Sandbox mode**: Bash commands can run in a sandboxed environment that restricts filesystem and network access. See the [sandboxing documentation](https://code.claude.com/docs/en/sandboxing.md) for details.
2525
from line 79
7979**How it works:**
8080
8181* **Filesystem**: Uses OS primitives (`bubblewrap` on Linux, `sandbox-exec` on macOS) to restrict read/write access to configured paths
82* **Network**: Removes network namespace (Linux) or uses Seatbelt profiles (macOS) to route network traffic through a built-in proxy
82* **Network**: Runs commands in their own network namespace (Linux) or under a Seatbelt profile (macOS) and routes their traffic through a built-in proxy that allows the configured domains. A connection to an outside host that skips the proxy fails.
8383* **Configuration**: JSON-based allowlists for domains and filesystem paths
8484
8585**Setup:**
8686
87```bash theme={null}
88npm install @anthropic-ai/sandbox-runtime
89```
87For the install, configuration, and launch steps, see [Set up and launch the runtime](https://code.claude.com/docs/en/sandbox-environments.md#set-up-and-launch-the-runtime).
9088
91Then create a configuration file specifying allowed paths and domains.
92
9389**Security considerations:**
9490
95911. **Same-host kernel**: Unlike VMs, sandboxed processes share the host kernel. A kernel vulnerability could theoretically enable escape. For some threat models this is acceptable, but if you need kernel-level isolation, use gVisor or a separate VM.
9692
972. **No TLS inspection**: The proxy allowlists domains based on the client-supplied hostname and does not terminate or inspect encrypted traffic. Code running inside the sandbox can potentially use [domain fronting](https://en.wikipedia.org/wiki/Domain_fronting) or similar techniques to reach hosts outside the allowlist. If your threat model requires stronger guarantees, configure a [TLS-terminating proxy](#traffic-forwarding). See the [sandboxing security limitations](https://code.claude.com/docs/en/sandboxing.md#security-limitations) for more detail. Separately, if the agent has permissive credentials for an allowed domain, ensure it cannot use that domain to trigger other network requests or to exfiltrate data.
932. **No TLS inspection**: By default, the proxy allowlists domains based on the client-supplied hostname and doesn't terminate or inspect encrypted traffic. Code running inside the sandbox can potentially use [domain fronting](https://en.wikipedia.org/wiki/Domain_fronting) or similar techniques to reach hosts outside the allowlist. If your threat model requires stronger guarantees, use a TLS-terminating proxy that inspects traffic, as [Traffic forwarding](#traffic-forwarding) describes. For more information, see the [sandboxing security limitations](https://code.claude.com/docs/en/sandboxing.md#security-limitations).
9894
953. **Credentials for allowed domains**: If the agent has permissive credentials for an allowed domain, ensure it cannot use that domain to trigger other network requests or to exfiltrate data.
96
9997For many single-developer and CI/CD use cases, sandbox-runtime raises the bar significantly with minimal setup. The sections below cover containers and VMs for deployments requiring stronger isolation.
10098
10199### Containers
from line 129
131129| `--security-opt seccomp=...` | Restricts available syscalls; Docker's default blocks \~44, custom profiles can block more |
132130| `--read-only` | Makes the container's root filesystem immutable, preventing the agent from persisting changes |
133131| `--tmpfs /tmp:...` | Provides a writable temporary directory that's cleared when the container stops |
134| `--network none` | Removes all network interfaces; the agent communicates through the mounted Unix socket below |
132| `--network none` | Cuts the container off from external networks |
135133| `--memory 2g` | Limits memory usage to prevent resource exhaustion |
136134| `--pids-limit 100` | Limits process count to prevent fork bombs |
137135| `--user 1000:1000` | Runs as a non-root user |
from line 138
140138
141139**Unix socket architecture:**
142140
143With `--network none`, the container has no network interfaces at all. The only way for the agent to reach the outside world is through the mounted Unix socket, which connects to a proxy running on the host. This proxy can enforce domain allowlists, inject credentials, and log all traffic.
141With `--network none`, a DNS lookup or a direct connection to another host fails inside the container. To let code in the container reach other hosts, run a proxy on the host and mount its Unix socket into the container. If you point `ANTHROPIC_BASE_URL` or `HTTP_PROXY` at a port on `localhost`, as [Configuring Claude Code to use a proxy](#configuring-claude-code-to-use-a-proxy) shows, relay that port inside the container to the socket.
144142
145This is the same architecture used by [sandbox-runtime](https://github.com/anthropics/sandbox-runtime). Even if the agent is compromised via prompt injection, it cannot exfiltrate data to arbitrary servers. It can only communicate through the proxy, which controls what domains are reachable. For more details, see the [Claude Code sandboxing blog post](https://www.anthropic.com/engineering/claude-code-sandboxing).
143You can set up this proxy to enforce domain allowlists, inject credentials, and log all traffic.
144
145> [!WARNING]
146>
147> Within your proxy's allowlist, the agent can send data to any allowed domain. Allow only the domains the agent needs.
146148
147149**Additional hardening options:**
148150
No line in this hunk matches that.