What
sandbox.excludedCommands lets you name commands that always run outside the sandbox. Claude Code now parses the actual command line more carefully to catch cases where a command, or a wrapper around it, technically matches an allowlisted entry but is actually being used to slip past the sandbox. It recognizes things like:
- Trusted versus untrusted uses of
env - Dangerous interpreter or shell flags, such as
-c,--eval,-e, or PowerShell's-command/-encodedcommand, across dozens of tools including bash, python, perl, ruby, php, node, git, docker, kubectl, aws, and pwsh - Tricks involving
IFSor positional parameters - Risky glob expansion
- Git subcommands that can read or write outside the repository, such as
clone,worktree add,bundle create, andconfigchanges to dangerous keys likecore.sshcommandorcore.hookspath
Why
This closes off ways a command could use an excludedCommands entry as a loophole to run unsandboxed code that reaches beyond what was intended, building on earlier work that tied the exclusion list to whether unsandboxed commands are allowed at all.
Names in the bundlesandbox.excludedCommands
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.excludedCommands, on All settings.
| [`sandbox.excludedCommands`](#sandbox-excludedcommands) | Name commands Claude Code can run outside the [sandbox](/docs/en/sandboxing) | Sandbox settings | Any file |settings-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up sandbox.excludedCommands, on All settings.
Anthropic's release notes agree
Fixed a sandbox.excludedCommands glob exempting an entire compound Bash command from the sandbox when only one part matched; every part must…