Type: url
Original: https://www.anthropic.com/engineering/how-we-contain-claude
Status: partial
Summary
An Anthropic engineering post (May 2026) on capping the blast radius of agents through containment rather than per-action human approval. It classifies agent security risks (user misuse, model misbehavior, external attackers) and defensive components (environment, model, external content), then describes three isolation patterns — an ephemeral gVisor container for claude.ai, a human-in-the-loop OS sandbox for Claude Code, and a local VM for Claude Cowork — together with incidents the authors missed, and closes with principles: contain at the environment layer first, match isolation to the user’s capacity for oversight, and be wary of custom components.