Anthropic has launched a local Bash sandbox mode for Claude Code on desktop, isolating command execution at the operating system level. On macOS, Seatbelt enforces process-level restrictions, while Linux and WSL2 users get bubblewrap, a lightweight containerization tool. This approach has achieved an 84% reduction in permission prompts since development began around October 2025. The sandbox protects against prompt injection attacks by restricting filesystem access to the current working directory and filtering network connections to pre-approved domains. Windows users are not supported for now, and computer use features operate outside the sandbox environment.
Source: Read the original article
