Claude Code Sandbox: What It Blocks and How to Turn It On

The boundary limits writes and network access, but it does not make the whole application a sealed container. Commands can still read most of the machine unless you deny paths, and Claude's file tools, MCP servers and hooks run outside the sandbox.

A developer turns on /sandbox to stop approving every routine shell command and assumes Claude is now boxed in. Anthropic says sandboxing reduced permission prompts by 84% in its internal usage. The useful boundary is real, but it covers shell commands rather than every tool and service Claude Code can reach.

What the sandbox blocks by default

Anthropic documents these defaults for sandboxed commands.

Claude Code sandbox defaults, checked 3 November 2026

Source: Anthropic, Claude Code sandboxing, read 3 November 2026.

The same distinction matters when a model describes your company: controls on a local command do not change what ChatGPT or Gemini can find and say about your brand. Xtrusio checks those public answers, the competitors that appear instead and the gaps worth fixing.

What runs outside the sandbox

The sandbox wraps shell commands and their child processes. Built-in file and web tools follow permission rules instead. Command hooks, local MCP servers, plugin monitors, LSP servers and helper commands run with the user's access.

Inside or outside the Claude Code sandbox

To place the whole Claude Code process behind one boundary, Anthropic suggests a container, virtual machine or the sandbox runtime.

How to turn on the sandbox

Follow these steps in a supported environment.

1. Run /sandbox. The command opens the sandbox panel.
2. Choose a mode. Auto-allow runs sandboxed commands without prompting, while regular permissions keeps normal prompts.
3. Run a command. Ask Claude to run a build, test or another harmless command.
4. Check with the two probes. Ask Claude to run the official filesystem and network checks below.
5. Close the escape hatch. Disable unsandboxed retries when you need a strict boundary.

The panel saves a chosen mode to .claude/settings.local.json. The sandbox works on macOS, Linux and WSL2, but not native Windows. Linux and WSL2 use bubblewrap and socat; macOS uses Seatbelt.

For one session, Anthropic gives this command:

claude --settings '{"sandbox": {"enabled": true, "allowUnsandboxedCommands": false}}'

Source: Anthropic, Claude Code docs, Configure the sandboxed Bash tool, read 3 November 2026.

Check the sandbox is really on

Ask Claude to run these commands. Typing them yourself at the ! prompt does not test the sandbox because that prompt usually runs outside it.

touch ~/sandbox-probe
curl --noproxy '*' https://example.com

The first command should fail with Operation not permitted on macOS or Read-only file system on Linux and WSL2. The second should fail with Could not resolve host because it bypasses the proxy and has no direct network route.

These are Anthropic's checks, not a test we ran on this computer. Decline if Claude offers to retry either command outside the sandbox.

Close the escape hatch

By default, Claude can ask to retry a blocked command outside the sandbox. Set allowUnsandboxedCommands to false to remove that route. Set failIfUnavailable to true when Claude Code must stop instead of falling back to unsandboxed commands if the sandbox cannot start.

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

Source: Anthropic, Claude Code docs, Configure the sandboxed Bash tool, read 3 November 2026.

Sandbox vs permissions vs containers

Permission rules decide which tools Claude Code can use before a tool runs. The sandbox enforces filesystem and network limits while a shell command runs. The controls are complementary.

A container or virtual machine can wrap the entire Claude Code process, including tools and services that the shell sandbox leaves outside. That is the broader boundary to consider for unattended or higher-risk work.

What the sandbox does not protect against

These limits still matter after sandboxing is enabled.

• It does not inspect TLS traffic by default.
• A broad allowed domain can still create a path for data to leave.
• Allowing the Docker socket effectively grants access to the host.
• Secrets in readable files and inherited environment variables remain exposed unless you deny or scrub them.

A stricter settings example

Our example (illustrative). This user-level settings.json closes the fallback, readable-credential and open-network gaps described above.

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "filesystem": {
      "denyRead": ["~/.ssh", "~/.aws"]
    },
    "network": {
      "allowedDomains": ["github.com", "registry.npmjs.org"]
    }
  }
}

enabled turns on the shell boundary.

failIfUnavailable stops Claude Code from falling back when the sandbox cannot start.

allowUnsandboxedCommands set to false removes the retry outside the sandbox.

filesystem.denyRead blocks sandboxed commands from reading the two credential directories.

network.allowedDomains limits the proxy to the two named hosts.

Avoid a broad wildcard domain because it can reopen a route for data to leave.

Source: Anthropic, Claude Code sandboxing, read 3 November 2026.

Verdict

Turn on the sandbox, remove its fallback and narrow the files and hosts shell commands can reach, but use broader isolation when the whole process needs a boundary. For the separate question of how public AI systems describe your company, Get your free AI visibility check.

Sources

• Anthropic: Claude Code sandboxing, read 3 November 2026
• Anthropic engineering: Claude Code sandboxing, read 3 November 2026
• Anthropic: Claude Code settings, read 3 November 2026