Sandboxing — contain the blast radius
Assume the agent will eventually do something wrong. Sandboxing is how you make that a small mistake instead of a catastrophic one.
The threat
An agent running as your OS user can read your SSH keys, delete your files, publish to your GitHub, and charge your credit card. The probability of a serious mistake over a year of use is not low — the question is how much damage it can do when it happens.
What to do about it
-
1. Run agents as a dedicated non-root user
On Linux/macOS, create an 'agent' user. The agent can't read your home dir, your SSH keys, or your browser profile.
-
2. Use containers for stateful work
Docker/Podman with read-only root filesystem and a dedicated data volume. Agent goes rogue? Kill the container.
-
3. Use IronClaw (or equivalent) for production-adjacent agents
Process-level capability enforcement. Agent can only do what its manifest declares — not what it can convince you to let it do.
-
4. Never give an agent sudo or admin
If a task needs privileged access, you do that part. Full stop.
-
5. Make the network allowlist fail closed, not prompt
An allowlist that asks permission is only a boundary while someone is watching. Claude Code v2.1.219 (July 25, 2026) added
sandbox.network.strictAllowlist, which denies non-allowlisted hosts for sandboxed commands without prompting. Previously an unexpected host produced a prompt — which means an unattended run either stalled or got approved by whoever was nearest. Strict mode fails closed instead.If you run any agent unattended — scheduled jobs, CI, a self-hosted runner — this is the setting that turns the allowlist from advisory into an actual boundary. Set it before you automate, not after an exfiltration attempt teaches you why.
Real-world examples
- An agent with shell access ran rm -rf ./node_modules — except it was in the user's home directory, and the command expanded differently than the prompt intended.
- A coding agent pushed a feature branch with secrets to the wrong repo (public). Sandbox would have prevented git-push entirely.
Examples are illustrative, composited from public incident reports and community posts.
Applies to
← Back to the security hub · See also the hardening checklist.