How we contain Claude across products · Simon Willison's Weblog
Science, Technology & Innovation · May 30, 2026
Anthropic tailors containment to each product—gVisor for Claude.ai, Seatbelt/Bubblewrap for local Claude Code, and full VMs (Apple Virtualization/HCS) for Claude Cowork—demonstrating that AI sandboxing is a portfolio of deployment-specific isolation choices with implications for builders and investors.
How we contain Claude across products · Simon Willison's Weblog
Science, Technology & Innovation · May 30, 2026
A publication detailing Anthropic’s Sandbox Runtime (srt) containment mechanisms has increased perceived maturity and confidence—prompting renewed expert evaluation and likely boosting adoption of open-source AI containment tooling while strengthening platform influence via documented security primitives.
How we contain Claude across products · Simon Willison's Weblog
Science, Technology & Innovation · May 30, 2026
Anthropic’s containment model prevents misuse by denying agents access to sensitive resources via multilayer hard boundaries (process sandboxes, VMs, filesystem limits, egress controls) and explicit capability deprivation—keeping credentials and other sensitive inputs out of the agent environment—so systems should be judged by what inputs/files/network destinations are structurally unreachable, not by generic ‘sandboxed AI’ claims.
How we contain Claude across products · Simon Willison's Weblog
Science, Technology & Innovation · May 30, 2026
Anthropic’s documentation openly discloses missed risks and exfiltration vectors (e.g., api.anthropic.com/v1/files), and this transparency—contrasted with poorly documented sandboxes—gives operators a higher-information basis to assess trust and should be treated as an important due-diligence signal when selecting agent platforms.