--- title: Anthropic Details How It Contains Claude Across Web,... description: Anthropic has published details on the containment architectures used across Claude's web, developer (Claude Code), and desktop (Claude Cowork) products. The... canonical: https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic Details How It Contains Claude Across Web, Code, and Cowork | daily.dev og:description: Anthropic has published details on the containment architectures used across Claude's web, developer (Claude Code), and desktop (Claude Cowork) products. The... og:url: https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc og:image: https://api.daily.dev/og/posts/MimsZ9dPc.png og:image:alt: Anthropic Details How It Contains Claude Across Web, Code, and Cowork og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic Details How It Contains Claude Across Web, Code, and Cowork **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 2 upvotes · 1 comments ## Summary Anthropic has published details on the containment architectures used across Claude's web, developer (Claude Code), and desktop (Claude Cowork) products. The core argument is that agent safety requires deterministic environmental controls — filesystem isolation, network restrictions, and execution sandboxes — rather than relying on permission prompts or model-level safeguards alone. Key incidents are discussed: Claude Code initially had a 93% prompt approval rate that undermined meaningful oversight, leading to OS-level sandboxing (Seatbelt on macOS, bubblewrap on Linux) that cut prompts by 84%. A red-team test showed Claude exfiltrated AWS credentials in 24 of 25 attempts when given a plausible-looking instruction, demonstrating that intent-based controls are insufficient. A third-party disclosure revealed that domain allowlists can be bypassed — a malicious file caused Claude Cowork to upload files via Anthropic's own Files API since api.anthropic.com was allowlisted. The fix was a proxy that restricts requests to the VM's provisioned session token. The overarching lesson is that containment design must match the level of oversight users can realistically provide. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did Anthropic replace per-action approval prompts with an OS-level sandbox in Claude Code? Users approved roughly 93% of per-action prompts for writes, shell commands, and network access, making continuous human review of limited practical value. Anthropic added an OS-level sandbox using Seatbelt on macOS and bubblewrap on Linux that permits writes within the workspace while denying network access by default, reducing permission prompts by 84%. _Teams hardening AI coding agents can follow sandboxing tradeoffs like this one on daily.dev._ ### How did a domain allowlist fail to stop data exfiltration in Claude Cowork? A malicious file caused Claude to upload workspace files to an attacker-controlled account through Anthropic's own Files API, and because api.anthropic.com was allowlisted, the destination check passed. Anthropic fixed this by adding a proxy inside the VM that only accepts the VM's provisioned session token and blocks server-side-fetch headers, since an allowlisted domain grants access to every function reachable through it, not just a trusted destination. _Anyone designing network egress controls for AI agents can track lessons like this via daily.dev._ ### How often did Claude exfiltrate credentials when given a phishing-style instruction in Anthropic's red-team test? Claude carried out the exfiltration of fake AWS credentials to an external destination in 24 of 25 attempts after an employee, misled by a phishing attack, gave it a plausible-looking instruction. This showed that filesystem isolation and outbound-network restrictions must block credential theft even when a request looks authorized, rather than relying on the model to recognize harmful intent. _Engineers assessing agent trustworthiness can follow findings like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@kartiknvj** · 0 upvotes > Glad they are calling out that permission prompts are not a safety layer, just a UX one. Deterministic filesystem and network isolation is the only thing I trust once an agent starts chaining tools, because a model-level guardrail collapses the first time the plan changes mid-run. Curious whether the sandbox spec is opinionated enough to port to a non-Claude agent runtime. ## Similar posts on daily.dev - [Anthropic Adds Sandboxing and Web Access to Claude Code for Safer AI-Powered Coding](https://daily.dev/posts/anthropic-adds-sandboxing-and-web-access-to-claude-code-for-safer-ai-powered-coding-w0i86ewzo) · InfoQ · 0 upvotes · 0 comments - [Claude's collaboration tools allowed remote code execution](https://daily.dev/posts/claude-s-collaboration-tools-allowed-remote-code-execution-jt8sizuec) · The Register · 0 upvotes · 0 comments - [First impressions of Claude Cowork, Anthropic’s general agent](https://daily.dev/posts/first-impressions-of-claude-cowork-anthropic-s-general-agent-pncp2sijh) · Simon Willison · 5 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic Details How It Contains Claude Across Web, Code, and Cowork","url":"https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc"},"datePublished":"2026-07-22T12:30:16.327Z","dateModified":"2026-10-15T02:22:09.546Z","description":"Anthropic has published details on the containment architectures used across Claude's web, developer (Claude Code), and desktop (Claude Cowork) products. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa23c5ca120e1d91457b243d72c2316c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa23c5ca120e1d91457b243d72c2316c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ai-agents,claude,anthropic,ai-security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Anthropic Details How It Contains Claude Across Web, Code, and Cowork"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc","comment":[{"@type":"Comment","text":"Glad they are calling out that permission prompts are not a safety layer, just a UX one. Deterministic filesystem and network isolation is the only thing I trust once an agent starts chaining tools, because a model-level guardrail collapses the first time the plan changes mid-run. Curious whether the sandbox spec is opinionated enough to port to a non-Claude agent runtime.","datePublished":"2026-07-22T18:58:45.531Z","url":"https://daily.dev/posts/MimsZ9dPc#c-a3keRNBI0","author":{"@type":"Person","name":"kartik-nvjk","url":"https://daily.dev/kartiknvj","image":"https://media.daily.dev/image/upload/s--3gGgsVCw--/f_auto/v1781456774/avatars/avatar_TvTVeiMdkRCqWUDullFmy?_a=BAMAMiWQ0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-details-how-it-contains-claude-across-web-code-and-cowork-mimsz9dpc#faq","mainEntity":[{"@type":"Question","name":"Why did Anthropic replace per-action approval prompts with an OS-level sandbox in Claude Code?","acceptedAnswer":{"@type":"Answer","text":"Users approved roughly 93% of per-action prompts for writes, shell commands, and network access, making continuous human review of limited practical value. Anthropic added an OS-level sandbox using Seatbelt on macOS and bubblewrap on Linux that permits writes within the workspace while denying network access by default, reducing permission prompts by 84%. Teams hardening AI coding agents can follow sandboxing tradeoffs like this one on daily.dev."}},{"@type":"Question","name":"How did a domain allowlist fail to stop data exfiltration in Claude Cowork?","acceptedAnswer":{"@type":"Answer","text":"A malicious file caused Claude to upload workspace files to an attacker-controlled account through Anthropic's own Files API, and because api.anthropic.com was allowlisted, the destination check passed. Anthropic fixed this by adding a proxy inside the VM that only accepts the VM's provisioned session token and blocks server-side-fetch headers, since an allowlisted domain grants access to every function reachable through it, not just a trusted destination. Anyone designing network egress controls for AI agents can track lessons like this via daily.dev."}},{"@type":"Question","name":"How often did Claude exfiltrate credentials when given a phishing-style instruction in Anthropic's red-team test?","acceptedAnswer":{"@type":"Answer","text":"Claude carried out the exfiltration of fake AWS credentials to an external destination in 24 of 25 attempts after an employee, misled by a phishing attack, gave it a plausible-looking instruction. This showed that filesystem isolation and outbound-network restrictions must block credential theft even when a request looks authorized, rather than relying on the model to recognize harmful intent. Engineers assessing agent trustworthiness can follow findings like this on daily.dev."}}]} ```