New heuristics detect commands trying to escape the sandbox via the excludedCommands allowlist
sandbox.excludedCommands lets you name commands that always run outside the sandbox. Claude Code now parses the actual command line more carefully to catch cases where a command, or a wrapper around it, technically matches an allowlisted entry but is actually being used to slip past the sandbox. It recognizes things like:
- Trusted versus untrusted uses of
env - Dangerous interpreter or shell flags, such as
-c,--eval,-e, or PowerShell's-command/-encodedcommand, across dozens of tools including bash, python, perl, ruby, php, node, git, docker, kubectl, aws, and pwsh - Tricks involving
IFSor positional parameters - Risky glob expansion
- Git subcommands that can read or write outside the repository, such as
clone,worktree add,bundle create, andconfigchanges to dangerous keys likecore.sshcommandorcore.hookspath
This closes off ways a command could use an excludedCommands entry as a loophole to run unsandboxed code that reaches beyond what was intended, building on earlier work that tied the exclusion list to whether unsandboxed commands are allowed at all.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| [`sandbox.excludedCommands`](#sandbox-excludedcommands) | Name commands Claude Code can run outside the [sandbox](/docs/en/sandboxing) | Sandbox settings | Any file |settings-reference see the edit
Anthropic's documentation has since written up sandbox.excludedCommands, on All settings.
Fixed a sandbox.excludedCommands glob exempting an entire compound Bash command from the sandbox when only one part matched; every part must…