---
title: "How we contain Claude across products"
description: "Anthropic describes how it contains Claude across claude.ai, Claude Code, and Claude Cowork as model capabilities and access expand the potential blast radius of autonomous agents. It distinguishes user misuse, model misbehavior, and external attackers, then assigns defenses across the agent’s environment, the model, and external content such as MCP servers, plugins, and web results. The main containment patterns include ephemeral gVisor containers for claude.ai, while Claude Code’s sandboxing and Cowork’s virtual-machine design tailor isolation to different users and capabilities. Reported measurements show Claude Opus 4.7 at roughly 0.1% attack success on single prompt-injection attempts and Claude Code auto mode catching roughly 83% of overeager behaviors, but neither replaces hard environmental boundaries. The conclusion favors mature isolation primitives, least-necessary access, and defense in depth because probabilistic safeguards can miss failures and permitted egress can still expose data."
---

# How we contain Claude across products

[Anthropic](https://yomu.fyi/company/anthropic) · May 25, 2026

**Type:** Explainer

## Summary

Anthropic describes how it contains Claude across claude.ai, Claude Code, and Claude Cowork as model capabilities and access expand the potential blast radius of autonomous agents. It distinguishes user misuse, model misbehavior, and external attackers, then assigns defenses across the agent’s environment, the model, and external content such as MCP servers, plugins, and web results. The main containment patterns include ephemeral gVisor containers for claude.ai, while Claude Code’s sandboxing and Cowork’s virtual-machine design tailor isolation to different users and capabilities. Reported measurements show Claude Opus 4.7 at roughly 0.1% attack success on single prompt-injection attempts and Claude Code auto mode catching roughly 83% of overeager behaviors, but neither replaces hard environmental boundaries. The conclusion favors mature isolation primitives, least-necessary access, and defense in depth because probabilistic safeguards can miss failures and permitted egress can still expose data.

## Context

As Claude’s capabilities and access expand, both the likelihood of failure and the potential blast radius of an autonomous agent must be managed. The post frames deployment as a risk-reward decision and focuses on limiting damage when safeguards or supervision fail.

## Approach / What changed

The post separates defenses across the agent’s environment, model, and external content, emphasizing containment through sandboxes, virtual machines, filesystem boundaries, egress controls, and constrained tool permissions. It compares isolation patterns for claude.ai, Claude Code, and Claude Cowork, alongside model-based safeguards such as classifiers and approval automation.

## Takeaways

- Anthropic identifies three agent-risk categories: user misuse, model misbehavior, and external attackers, and maps defenses to the environment, model, and external content.
- Claude Code users approved roughly 93% of permission prompts; auto mode catches roughly 83% of overeager behaviors, but its probabilistic protection is intended to operate inside a sandbox rather than replace one.
- The post recommends mature hypervisors, syscall filters, and container runtimes because standard primitives held across deployments while custom components exposed flaws.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Sandboxing](https://yomu.fyi/topic/sandboxing), [Security](https://yomu.fyi/topic/security)

- Source: [Anthropic](https://www.anthropic.com/engineering/how-we-contain-claude)
- Source URL: https://www.anthropic.com/engineering/how-we-contain-claude
- Ingested by Yomu: 2026-09-09T11:38:28.513Z

[Read original post](https://www.anthropic.com/engineering/how-we-contain-claude)