Anthropic 首次公开了 Claude 系列产品的沙箱实现细节，做 AI 安全或部署 LLM 应用的团队可以据此评估信任边界，建议直接阅读原文了解具体漏洞案例。
Anthropic 发布了一篇详细的技术文章，介绍了如何在 Claude.ai、Claude Code 和 Claude Cowork 三个产品中实现沙箱隔离。文章解释了不同产品使用的沙箱技术：Claude.ai 使用 gVisor，Claude Code 在本地运行并使用 macOS 的 Seatbelt 和 Linux 的 Bubblewrap，而 Claude Cowork 则运行完整的虚拟机。文章还披露了一些之前未公开的安全风险，例如通过 api.anthropic.com/v1/files 进行数据泄露的漏洞。这篇文档填补了行业在沙箱产品文档化方面的空白，让用户能更清楚地评估其安全性。
How we contain Claude across products
How we contain Claude across products A complaint I often have about sandboxing products is that they are rarely thoroughly documented , and in the absence of detailed documentation it's hard to know how much I can trust them. Anthropic just published a fantastic overview of how their various sandbox techniques work across Claude.ai , Claude Code, and Cowork. We constrain where and how an agent can act with process sandboxes, VMs, filesystem boundaries, and egress controls. The goal is to set a hard boundary on what an agent can reach. For example, if credentials never enter the sandbox, they can't be exfiltrated, regardless of whether the cause is a user, a model finding a “creative” path, or an attacker. Claude.ai uses gVisor. Claude Code, run locally, uses Seatbelt on macOS and Bubblewrap on Linux. Claude Cowork runs a full VM (Apple's Virtualization framework on macOS, HCS on Windows). There's a lot in here, including some interesting stories of risks they missed such as the api.anthropic.com/v1/files exfiltration vector covered here previously . This reminded me it's time I took another look at Anthropic's open source srt (Anthropic Sandbox Runtime) tool - it's mature enough know that I'm ready to give it a proper go. Tags: sandboxing , security , ai , generative-ai , llms , anthropic , claude , claude-code