{"version":"2.1.314","anchor":"sandbox-xpc-description-warns-of-escape","canonical_anchor":"sandbox-xpc-description-warns-of-escape","heading":"Sandbox setting for macOS service lookups now warns that it can reach outside","tier":"notice","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/sandbox-xpc-description-warns-of-escape","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Sandbox setting for macOS service lookups now warns that it can reach outside\n\nThe description of the allowed Mach lookup sandbox setting now warns that each entry lets sandboxed commands reach outside services\n\n**What**\n\nThe sandbox is a restricted space where Claude Code runs commands so they cannot freely touch the rest of your computer. On macOS, one sandbox setting lists the system services that sandboxed commands may look up, called Mach lookups. Its description now warns: \"Each entry lets sandboxed commands reach services outside the sandbox, and the sandbox does not confine what those services do for them.\"\n\n**Why**\n\nEvery entry you add to this list loosens the sandbox. The warning makes that clear before you add one.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}