Anthropic Details Claude's Security Isolation Architecture to Constrain Agent Behavior

In its latest technical sharing, Anthropic argues that agent security cannot rely on permission confirmations or the model's own safety mechanisms, but should instead establish deterministic security boundaries through infrastructure such as the file system, network, and execution environment. The company categorizes risks into three types: user misuse, model misbehavior, and attacks launched through file or network content.

Anthropic believes that classifiers, system prompts, and model training can only influence behavior, not provide absolute guarantees; what truly determines what an agent can access and send out is the limitation of the runtime environment. This perspective runs through the design of its web, developer, and desktop products.

Claude Code initially used a per-action authorization mechanism, requiring user confirmation for every file write, shell command execution, or network access. However, Anthropic found that users ultimately approved about 93% of permission requests, significantly diminishing the security value of human confirmation.

To address this, Anthropic introduced OS-level sandboxing: Seatbelt on macOS and bubblewrap on Linux. The new design allows the agent to read and write files in the current workspace but disables network access by default, reducing permission confirmation pop-ups by 84%.

Additionally, Anthropic fixed a configuration parsing vulnerability: previously, Claude Code would parse local configuration files, such as auto-hooks in .claude/settings.json, even when the user had not confirmed trust in the project directory. Now, it only parses and executes after the user explicitly trusts the project.

Anthropic shared a controlled red-team test to demonstrate the limitations of relying solely on permission confirmations or classifiers to judge user intent. Attackers used phishing to trick an employee, then had Claude Code read AWS credentials and send them to an external address.

The result: in 25 tests, Claude executed data exfiltration in 24 cases. This shows that even if a request appears to come from a legitimate user, authorization mechanisms alone cannot be relied upon; underlying mechanisms like file system isolation and outbound network restrictions must be able to prevent credential theft.

Claude Cowork targets users who find it harder to judge shell command safety, so it adopts stricter isolation: initially running entirely within a virtual machine, mounting only user-specified directories, with credentials stored in the host's keychain. Later, to improve reliability, the agent's main loop was moved to the host, while code execution remained in the VM.

However, the domain whitelist mechanism exposed a limitation: third-party security researchers disclosed that a malicious file could trick Claude into uploading workspace files to an attacker's account via Anthropic's own Files API, because api.anthropic.com was whitelisted.

Anthropic added a proxy layer inside the VM that only accepts session tokens generated for the current session and intercepts server-side request headers, thereby blocking such attacks. This incident illustrates that whitelisting a domain means allowing all its functionality, not just a specific endpoint.

Anthropic concludes that agent security isolation mechanisms should be designed based on the level of effective supervision users can provide. Rather than relying solely on identifying malicious intent, it is more important to establish strict boundaries through the runtime environment, ensuring that even if an agent performs unsafe actions, the impact remains limited.

This architectural approach has implications for the industry: as agents become widespread, security design must shift from 'trusting the user' to 'defaulting to distrust,' replacing human judgment with infrastructure constraints.