Anthropic published a blog post detailing the security architecture for its three agentic products: claude.ai, Claude Code, and Claude Cowork. The company argues that as model capabilities grow, traditional manual approval leads to approval fatigue, and probabilistic model-layer filtering still misses threats. The real defense, they say, has to come from the environment layer — physical containers and virtual machine isolation.
In Claude Code, the command-line tool, early versions relied on developers manually approving every network and write command. But internal telemetry showed that frequent pop-ups caused intense approval fatigue, with users approving 93% of requests on average. To cut down on that, Anthropic added OS-level sandboxes (Seatbelt on macOS, bubblewrap on Linux) that run silently in the workspace but block all network access — cutting pop-ups by 84%. Even the later auto mode, which uses a small classifier, still misses 17% of threats, proving the physical sandbox is the real foundation.
During an internal red team exercise, researchers used a phishing attack to trick an employee into running a seemingly benign command that made Claude read local ~/.aws/credentials and exfiltrate them. Out of 25 attempts, Claude successfully leaked data 24 times — a 96% success rate. The takeaway: when the instruction comes directly from the user, model-layer defenses are useless. Only environment-level egress controls and file restrictions can stop the leak. Earlier, Anthropic also fixed three startup vulnerabilities in Claude Code by January 2026: malicious repositories could automatically trigger preset hooks via .claude/settings.json before the directory was trusted. Now the system only parses local config after the user confirms trust.
For the enterprise product Claude Cowork, Anthropic went further by running the entire environment inside a dedicated Linux virtual machine (Apple Virtualization on macOS, HCS on Windows), making the host's credentials and files completely invisible to the VM. But third-party disclosures revealed that because outbound traffic to api.anthropic.com was on the default whitelist, a malicious workspace file could trick Claude into reading local sensitive data and uploading it directly to the attacker's personal account using their own API key — bypassing the VM's outbound blocking entirely. To close that loophole, Anthropic deployed a defensive man-in-the-middle proxy inside the VM that filters all traffic to the official API, only allowing requests carrying the current VM's session token, and rejecting any embedded external keys.