Claude Code sandbox
Ranked 3 of 17 agent sandboxes by recommenders
Sandbox built into Claude Code that cuts down permission prompts for commands. Critics say it gives read access to everything and is disabled by default.
Sandbox built into Claude Code that cuts down permission prompts for commands. Critics say it gives read access to everything and is disabled by default.
34 people gave an opinion
- recommend it
- 16
- criticize it
- 18
- approval share
- 47%
Recommended in 6 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 16 people recommend itNeeds 10 or more, met.
- 0.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Very simple to enable
“very simple to enable, if nothing else”
Comment from 31 Aug 2026 in “Breaking Claude Code Opus 5 Auto Mode” “Esp with the simplicity of /sandbox”
Comment from 30 Dec 2025 in “Show HN: A Claude Code plugin that catch destructive Git and filesystem commands” Fewer permission prompts for commands
“You can relax permissions while avoiding the flag with BashTool sandboxing”
Comment from 13 Mar 2026 in “Shall I implement it? No” “it stops asking for permission for these kinds of commands”
Comment from 13 Mar 2026 in “Shall I implement it? No” Balances safety and autonomy
“strike a good balance between safety and autonomy on macOS”
Comment from 13 Mar 2026 in “Shall I implement it? No” “You can relax permissions while avoiding the flag with BashTool sandboxing”
Comment from 13 Mar 2026 in “Shall I implement it? No”
What people warn about
Each mark is one comment
Read access to whole filesystem
“It still grants full read only access to the file system so any secrets in your home directory can still be exfiltrated.”
Comment from 22 Jan 2026 in “Running Claude Code dangerously (safely)” “Claude sandbox practically useless IMO. It gives read access to everything by default so its not deny-default.”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “the built in sandbox in Claude Code is bad (read only access to everything by default) and tightly coupled”
Comment from 8 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” - Comment from 4 Feb 2026 in “Show HN: Sx – macOS sandbox CLI for credential protection”
Breaks toolchains and Docker workflows
“had quite a job getting my toolchains and skills to work with it”
Comment from 28 Mar 2026 in “Don't YOLO your file system” “sanboxing breaks immediately when I need to docker compose run sometask.sh”
Comment from 28 Mar 2026 in “Don't YOLO your file system” Config can be changed or disabled
“could remove or simply change the config name just as silently as it was introduced”
Comment from 28 Mar 2026 in “Don't YOLO your file system” “there are reports that it can disable sandbox”
Comment from 15 Jan 2026 in “Claude Cowork Runs Linux VM via Apple Virtualization Framework”
Other agent sandboxes people recommend
The four most recommended other agent sandboxes, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Docker Sandboxes | 50 | 39 | 56% | 9 | — | — |
| NVIDIA OpenShell | 36 | 8 | 82% | 9 | — | Approved |
| Claude Code sandboxThis page | 16 | 18 | 47% | 6 | — | — |
| MXC (Microsoft Execution Containers) | 15 | 17 | 47% | 1 | — | — |
| microsandbox | 13 | 2 | 87% | 6 | — | Approved |
What people said
33 of the 35 comments that mention it, newest first. Each links to the original comment.
“a real security benefit but it just turned into an extra confirmation for me”
“very simple to enable, if nothing else”
“I think none of them is actually usable - they either allow too much or too little.”
“Anthropic are not interested in building an effective sandbox. It's a feelgood sandbox.”
“Claude's sandbox mode is also worse than having no sandbox feature at all.”
“Don't even need a separate user if you're on linux (or wsl), just use the sandbox feature”
“sanboxing breaks immediately when I need to docker compose run sometask.sh”
“this doesn’t always work as expected”
“had quite a job getting my toolchains and skills to work with it”
“if you think Claude is smart enough to block sneaky path strings based on your config”
“to be effective it would need to be implemented at a very low level”
“It will just do ssh you@localhost”
“Nice extra guardrail though, will add it to the project-level settings.”
“could remove or simply change the config name just as silently as it was introduced”
“it's great and pretty much this”
“It's disabled by default though, and in general (especially with other agents) you very much still have to get out of your way”
“it stops asking for permission for these kinds of commands”
“You can relax permissions while avoiding the flag with BashTool sandboxing”
“strike a good balance between safety and autonomy on macOS”
“it can only filter network requests by IP address”
“Claude Code has ways to escape its sandbox”
“the built in sandbox in Claude Code is bad (read only access to everything by default) and tightly coupled”
“with proper configuration (e.g. /sandbox with normal claude code) it is impossible for the agent to escape.”
“much more configurable than the default claude code sandbox”
“Claude sandbox practically useless IMO. It gives read access to everything by default so its not deny-default.”
“Claude's built-in sandbox allows read-only access everywhere”
“sandbox feature is not fully baked and does not seem to be high priority”
“It still grants full read only access to the file system so any secrets in your home directory can still be exfiltrated.”
“sandbox-exec on MacOS (ie. https://github.com/neko-kai/claude-code-sandbox ) seems like the perfect solution to me.”
“there are reports that it can disable sandbox”
“As I can't trust Claude Code to use a correct shell, I don't know why I would trust this feature.”
“Esp with the simplicity of /sandbox”
“Docs promised empty allowedDomains = no network access but Actually disabled all restrictions (macOS + Linux)”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.