The post frames the risk of deploying an agent as two components: how likely a failure is, and how much damage one could do — its “blast radius”. It argues that safeguards and model training have steadily reduced the first while the second only grows as capabilities and access expand, and that as agents take on work once done by a person or a team, the cost of not deploying tips the balance toward adoption provided products can be made safe. The engineering question then becomes how to cap the blast radius.
It describes two ways to do so. The first is supervising behavior through a Human-in-the-loop, which the post calls fallible: Claude Code telemetry showed users approving roughly 93% of permission prompts, with attention falling as approvals mounted — the Approval Fatigue that Claude Code’s auto mode was built to reduce. The second, and the post’s focus, is containment: supervising what an agent is able to do by enforcing access boundaries such as sandboxes, virtual machines and egress controls. It then walks through how Anthropic applies containment in three products, each with a different architecture, including the risks it missed.
Key Points
- Agent security risks are grouped into three categories: user misuse, model misbehavior (including more capable models finding unexpected paths around restrictions), and external attackers, including Prompt injection.
- Defenses are applied to three components: the environment the agent runs in, the model it consults, and the external content it can reach; the environment sets a hard boundary, while model-layer defenses shape only what the agent tends to do.
- Model-layer defenses are described as strong but never 100% effective; the post cites Claude Opus 4.7 holding attack success on a prompt-injection benchmark to roughly 0.1% on single attempts and around 5–6% after 100 adaptive attempts.
- claude.ai runs code in an ephemeral, server-side gVisor container: minimal blast radius, but no persistent workspace or access to the user’s files, and a more traditional threat model focused on protecting Anthropic’s infrastructure and separating tenants.
- Claude Code relies on the user as the human in the loop, which the post calls tractable only because its users are typically developers who can read bash; its OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) allows reads, allows writes inside the workspace and denies network by default, cutting permission prompts by 84%.
- Three vulnerabilities reported through Anthropic’s disclosure program targeted code that ran before the user accepted Claude Code’s folder-trust prompt — for example, a hook defined in a cloned repository’s
.claude/settings.json; the fix was to defer parsing and executing project-local configuration until after trust is granted. - In an internal red-team exercise, an employee phished into running a malicious prompt saw Claude exfiltrate credentials in 24 of 25 retries; the post classifies this as Direct Prompt Injection that model-layer defenses cannot catch, leaving egress controls and filesystem boundaries as the only defense that holds.
- Claude Cowork targets non-technical users who cannot be expected to judge bash, so it uses an absolute, always-on boundary: a local virtual machine that sees only the mounted workspace, with credentials kept in the host’s keychain.
- In a third-party disclosure, a file in a Cowork workspace carrying an attacker’s API key led Claude to upload files to the attacker’s account through the allowed
api.anthropic.comdomain; the post concludes an egress allowlist is better understood as a capability grant than a destination filter. - Across the incidents, the custom components Anthropic built — such as its allowlist proxy — failed, while battle-tested primitives such as hypervisors, seccomp and gVisor held.
- Any external resource given to an agent is both a supply-chain code-execution risk and a prompt-injection vector; remote tools can change behavior after approval, and tool output is an attack surface even when the tool is trusted.
- Emerging risks named include persistent memory poisoning, trust escalation between agents in multi-agent systems, and the unresolved question of agent identity.
- The closing principles are to design for containment at the environment layer first and steer behavior at the model layer second, match isolation strength to the user’s capacity for oversight, and be wary of custom components.
Context
The post is Anthropic’s account of its own products’ security architecture, including incidents it describes as risks it missed; the figures it gives come from its own telemetry, internal exercises and disclosures. It presents containment as one part of the security picture for agents, points to external guidance on governance and observability, and calls for collective investment across the industry in agent security. Its containment patterns connect to this wiki’s coverage of Sandboxing.