Claude Code Sandboxing and Security

An agent that can read your files, run shell commands, and reach the network is only as safe as the boundaries around it. Claude Code ships a real permission system, and by default it is genuinely conservative — Manual mode starts with read-only access and asks before anything that changes state. But "asks before it acts" is a behavioral safeguard: it depends on Claude correctly recognizing that an action is risky, and on you correctly recognizing that an approval prompt deserves scrutiny. Neither of those is guaranteed. A cleverly worded PR comment can talk a model into a bad decision the same way it could talk a distracted engineer into one. A permission mode chosen for convenience during a long unattended run removes exactly the checkpoint that would have caught it.

This subject is about the layer underneath good behavior: what happens when good behavior fails. Sandboxing constrains what a command can reach even if Claude decides to run something it shouldn't. Permission rules and hooks give you deterministic, auditable control that doesn't depend on a model's judgment in the moment. Managed settings let an organization make some of these decisions non-negotiable. None of this assumes malice on Claude's part — the same defenses that stop a compromised session also stop an honest mistake, a misread instruction, or a plausible-looking suggestion buried in content Claude was never supposed to treat as instructions in the first place. By the end of this subject you should be able to look at a real deployment — a solo laptop, a fintech monorepo, an unattended CI job — and say specifically which layers protect it and which gaps remain.