How we contain Claude across products

Summary

Anthropic describes how it contains Claude across claude.ai, Claude Code, and Claude Cowork as model capabilities and access expand the potential blast radius of autonomous agents. It distinguishes user misuse, model misbehavior, and external attackers, then assigns defenses across the agent’s environment, the model, and external content such as MCP servers, plugins, and web results. The main containment patterns include ephemeral gVisor containers for claude.ai, while Claude Code’s sandboxing and Cowork’s virtual-machine design tailor isolation to different users and capabilities. Reported measurements show Claude Opus 4.7 at roughly 0.1% attack success on single prompt-injection attempts and Claude Code auto mode catching roughly 83% of overeager behaviors, but neither replaces hard environmental boundaries. The conclusion favors mature isolation primitives, least-necessary access, and defense in depth because probabilistic safeguards can miss failures and permitted egress can still expose data.

Takeaways

1. 1

   Anthropic identifies three agent-risk categories: user misuse, model misbehavior, and external attackers, and maps defenses to the environment, model, and external content.

2. 2

   Claude Code users approved roughly 93% of permission prompts; auto mode catches roughly 83% of overeager behaviors, but its probabilistic protection is intended to operate inside a sandbox rather than replace one.

3. 3

   The post recommends mature hypervisors, syscall filters, and container runtimes because standard primitives held across deployments while custom components exposed flaws.