How we contain Claude across products

This post details Anthropic's engineering efforts in containing AI agents across products, specifically focusing on Claude.ai, Claude Code, and Claude Cowork. It outlines three categories of security risks (user misuse, model misbehavior, external attackers) and three layers of defense (environment, model, external content). For Claude Code, it describes the evolution from human-in-the-loop approvals to OS-level sandboxing (Seatbelt/bubblewrap) to mitigate approval fatigue and enhance security. It also highlights a critical vulnerability where project settings were parsed before user trust was established, leading to a fix that defers parsing and execution of project-local configurations until after the user accepts the trust prompt. The post emphasizes the importance of treating project-open, config-load, and localhost listeners with the same caution as inbound internet requests.