--- title: I gave Claude Code its own disposable computer, and... description: Claude Code includes a built-in sandbox, enabled via /sandbox, that lets the AI agent run commands and install software with auto-allow permissions instead of... canonical: https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I gave Claude Code its own disposable computer, and stopped caring what it installed | daily.dev og:description: Claude Code includes a built-in sandbox, enabled via /sandbox, that lets the AI agent run commands and install software with auto-allow permissions instead of... og:url: https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras og:image: https://api.daily.dev/og/posts/iqDDQHRAS.png og:image:alt: I gave Claude Code its own disposable computer, and stopped caring what it installed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I gave Claude Code its own disposable computer, and stopped caring what it installed **[XDA Developers](https://daily.dev/sources/xda-developers)** · 3 min read · 2 upvotes · 1 comments ## Summary Claude Code includes a built-in sandbox, enabled via /sandbox, that lets the AI agent run commands and install software with auto-allow permissions instead of requiring manual approval for every action. By default it can only write to the current project and a temp session directory, and it must ask before contacting new network domains. This makes it safer to test unfamiliar or malicious repositories, run destructive commands like rm -rf, or kill system services without risking the host machine. However, the sandbox isn't foolproof: a symlink vulnerability disclosed in April 2026 let a sandboxed process write outside the workspace, and a Git worktree issue could overwrite files like .zshenv in the home directory, potentially executing code outside the sandbox. Both were patched, but keeping Claude Code updated matters. For stronger isolation, a Docker container, VM, or Claude Code on the web (which runs each session in an Anthropic-managed isolated VM with scoped GitHub credentials) is recommended. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable Claude Code's sandbox to stop it from asking for command approval every time? Run /sandbox inside Claude Code to open a menu where you can choose auto-allow mode, which lets any command that can run within the sandbox execute automatically without stopping to ask for permission. This choice is saved in the project's local settings, or you can enable sandboxing globally through user settings. By default, sandboxed commands can only write to the current project and a temporary session directory, and network access to new domains still requires approval. _daily.dev surfaces practical workflow guides for developers automating their AI coding agent setups._ ### Is Claude Code's built-in sandbox completely safe from letting the AI escape to my main system? No, the sandbox is not foolproof because it is still software running on the same computer, and flaws in its boundary can expose the rest of the system. A vulnerability disclosed in April 2026 let a sandboxed process create a symlink pointing outside the workspace to write files elsewhere, and a separate Git worktrees issue could overwrite files like .zshenv in the home directory, enabling code execution outside the sandbox. Both were patched, so staying updated matters. _Developers weighing AI agent security risks can find analyses like this through daily.dev._ ### What's a stronger alternative to Claude Code's built-in sandbox for isolating an AI coding agent? A Docker container or virtual machine provides much stronger isolation than the built-in sandbox. Alternatively, Claude Code on the web runs each session inside an isolated virtual machine managed by Anthropic, requiring only a Claude subscription and a connected GitHub account; network traffic passes through a proxy with a default allowlist, and the GitHub token stays outside the sandbox while Claude receives only scoped repository credentials. _daily.dev helps developers compare isolation approaches before trusting an agent with real credentials._ ## Community discussion Top comments from developers on daily.dev. **@gabibeyo** · 0 upvotes > Disposable compute is a sane default for “try this weird repo.” I’m glad /sandbox exists. > > > Careful with the emotional landing though: “stopped caring what it installed” is exactly the containment fantasy enterprises are buying at scale. > > > A jail lowers blast radius. It does not change the creature. Coding agents still optimize for the goal — including finding the next volume mount, token, or human paste that expands the cage. > > > Use the sandbox. Then keep a trail of what it did inside. Otherwise you’ve built a nicer room for a hired hacker and called it bedtime. ## Similar posts on daily.dev - [I let Claude Code run wild in a virtual machine, and it changed how I use auto mode](https://daily.dev/posts/i-let-claude-code-run-wild-in-a-virtual-machine-and-it-changed-how-i-use-auto-mode-q1rsvahja) · XDA Developers · 0 upvotes · 0 comments - [Docker Sandboxes: Run Claude Code and More Safely](https://daily.dev/posts/docker-sandboxes-run-claude-code-and-more-safely-6ydoupfk7) · Docker · 1 upvotes · 0 comments - [Sandboxing local AI Agents](https://daily.dev/posts/sandboxing-local-ai-agents-jja6mrthe) · OctopusDeploy · 0 upvotes · 0 comments - [Anthropic Adds Sandboxing and Web Access to Claude Code for Safer AI-Powered Coding](https://daily.dev/posts/anthropic-adds-sandboxing-and-web-access-to-claude-code-for-safer-ai-powered-coding-w0i86ewzo) · InfoQ · 0 upvotes · 0 comments - [A better way to limit Claude Code \(and other coding agents\!\) access to Secrets – blog](https://daily.dev/posts/a-better-way-to-limit-claude-code-and-other-coding-agents-access-to-secrets-blog-yu0vomcjx) · Hacker News · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#claude-code](https://daily.dev/tags/claude-code), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I gave Claude Code its own disposable computer, and stopped caring what it installed","url":"https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras"},"datePublished":"2026-08-22T16:35:07.486Z","dateModified":"2026-09-13T21:10:56.031Z","description":"Claude Code includes a built-in sandbox, enabled via /sandbox, that lets the AI agent run commands and install software with auto-allow permissions instead of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e10480edb12269ad017623b96045556e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e10480edb12269ad017623b96045556e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ai-agents,docker,claude-code,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I gave Claude Code its own disposable computer, and stopped caring what it installed"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras","comment":[{"@type":"Comment","text":"Disposable compute is a sane default for “try this weird repo.” I’m glad /sandbox exists.\nCareful with the emotional landing though: “stopped caring what it installed” is exactly the containment fantasy enterprises are buying at scale.\nA jail lowers blast radius. It does not change the creature. Coding agents still optimize for the goal — including finding the next volume mount, token, or human paste that expands the cage.\nUse the sandbox. Then keep a trail of what it did inside. Otherwise you’ve built a nicer room for a hired hacker and called it bedtime.","datePublished":"2026-08-24T06:25:30.207Z","url":"https://daily.dev/posts/iqDDQHRAS#c-ueVKP703r","author":{"@type":"Person","name":"Gabi Beyo","url":"https://daily.dev/gabibeyo","image":"https://lh3.googleusercontent.com/a/ACg8ocLemxROLDZ6RYrC2zzv0zJ9ezzj62VOCNwxNCdVNa_M9tqvU4JI=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras#faq","mainEntity":[{"@type":"Question","name":"How do I enable Claude Code's sandbox to stop it from asking for command approval every time?","acceptedAnswer":{"@type":"Answer","text":"Run /sandbox inside Claude Code to open a menu where you can choose auto-allow mode, which lets any command that can run within the sandbox execute automatically without stopping to ask for permission. This choice is saved in the project's local settings, or you can enable sandboxing globally through user settings. By default, sandboxed commands can only write to the current project and a temporary session directory, and network access to new domains still requires approval. daily.dev surfaces practical workflow guides for developers automating their AI coding agent setups."}},{"@type":"Question","name":"Is Claude Code's built-in sandbox completely safe from letting the AI escape to my main system?","acceptedAnswer":{"@type":"Answer","text":"No, the sandbox is not foolproof because it is still software running on the same computer, and flaws in its boundary can expose the rest of the system. A vulnerability disclosed in April 2026 let a sandboxed process create a symlink pointing outside the workspace to write files elsewhere, and a separate Git worktrees issue could overwrite files like .zshenv in the home directory, enabling code execution outside the sandbox. Both were patched, so staying updated matters. Developers weighing AI agent security risks can find analyses like this through daily.dev."}},{"@type":"Question","name":"What's a stronger alternative to Claude Code's built-in sandbox for isolating an AI coding agent?","acceptedAnswer":{"@type":"Answer","text":"A Docker container or virtual machine provides much stronger isolation than the built-in sandbox. Alternatively, Claude Code on the web runs each session inside an isolated virtual machine managed by Anthropic, requiring only a Claude subscription and a connected GitHub account; network traffic passes through a proxy with a default allowlist, and the GitHub token stays outside the sandbox while Claude receives only scoped repository credentials. daily.dev helps developers compare isolation approaches before trusting an agent with real credentials."}}]} ```