Anthropic's Claude Code Sandbox
Comments on “Anthropic's Claude Code Sandbox”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Anthropic has published sandbox-runtime (srt), the OS-level sandbox behind Claude Code, as an Apache-2.0 npm package. It restricts filesystem and network access for arbitrary processes without a container, using Seatbelt on macOS, bubblewrap on Linux and an alpha Windows backend. Features include allow-only network policy and credential masking, and MCP servers can be wrapped by swapping the command to srt. The repo calls it a research preview with evolving APIs, and the Windows build cannot support Schannel-based tools. The claims come from the README and were not independently verified.
Why it ranked
No. 14 of 62 with a score of 0.67. The panel rated it highest on new information (0.92) and reader interest (0.80), lowest on audience breadth (0.56).
Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2
- Significance0.57
- Reader interest0.80
- Audience breadth0.56
- Practical relevance0.80
- Substantiated0.74
- Technical depth0.76
- New information0.92
- Counts against: Promotional0.10
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.58 | 0.45 | 0.68 | 0.57 | 0.23 | +0.24 | +0.137 |
| Reader interest | 0.71 | 0.80 | 0.90 | 0.80 | 0.19 | +0.26 | +0.209 |
| Audience breadth | 0.45 | 0.60 | 0.62 | 0.56 | 0.17 | +0.13 | +0.072 |
| Practical relevance | 0.82 | 0.75 | 0.82 | 0.80 | 0.07 | +0.22 | +0.175 |
| Substantiated | 0.83 | 0.55 | 0.84 | 0.74 | 0.29 | +0.05 | +0.037 |
| Technical depth | 0.79 | 0.70 | 0.78 | 0.76 | 0.09 | +0.05 | +0.038 |
| New information | 0.90 | 0.90 | 0.97 | 0.92 | 0.07 | +0.05 | +0.046 |
| Promotional | 0.08 | 0.15 | 0.08 | 0.10 | 0.07 | −0.19 | −0.020 |
| Overclaim | 0.19 | 0.30 | 0.08 | 0.19 | 0.22 | −0.11 | −0.021 |
| Sum of contributions | +0.674 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.673 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-26/14/"><img src="https://rubric.hrih.si/badge/2026-10-26/14.svg" alt="Ranked #14 on Rubric, 26 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 8 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkVersion
Anthropic released the sandbox behind Claude Code as an open-source npm package, @anthropic-ai/sandbox-runtime, under the Apache-2.0 license.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Anthropic has released the sandbox that runs behind Claude Code as an open-source npm package, `@anthropic-ai/sandbox-runtime`, under the Apache-2.0 license”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkQuote
The sandbox-runtime README describes srt as a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkVersion
On macOS, sandbox-runtime uses sandbox-exec with dynamically generated Seatbelt profiles, and on Linux it uses bubblewrap with network namespace isolation.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On macOS it uses `sandbox-exec` with dynamically generated Seatbelt profiles. On Linux it uses `bubblewrap` with network namespace isolation”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkVersion
The Windows build combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS ACLs, and ships a bundled srt-win.exe helper for x64 and arm64.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The Windows build combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS ACLs, and ships a bundled `srt-win.exe` helper for x64 and arm64”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkVersion
A one-time elevated windows-install step provisions a dedicated srt-sandbox local user account and the machine-wide WFP filter set.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A one-time elevated `windows-install` step provisions a dedicated `srt-sandbox` local user account and the machine-wide WFP filter set”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkVersion
The README lists an allow-only network policy with wildcard domain support, Unix-socket allowlisting, experimental TLS termination for HTTPS inspection, credential masking, and AWS SigV4 request signing with masked keys.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “an allow-only network policy with wildcard domain support, Unix-socket allowlisting, experimental TLS termination for MITM inspection of HTTPS, credential masking for environment variables and files, and AWS SigV4 request signing…”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkQuote
The repo calls the release a research preview developed for Claude Code to enable safer AI agents and warns that APIs and configuration formats may evolve.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a research preview developed for Claude Code to enable safer AI agents" and cautions that "APIs and configuration formats may evolve”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Couldn’t checkGeneralization
The Windows backend cannot be used with tools built on the Schannel TLS stack, such as System32\curl.exe, Invoke-WebRequest, .NET HttpClient and winget, and traffic through system services like Windows Update escapes the WFP fence.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “cannot be used, and traffic routed through system services such as Windows Update escapes the WFP fence”
The source says No passage could be compared.
Source cited by the article: github.com/anthropics/sandbox-runtime
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 26 Oct 2026, 07:27 UTC. It played no part in the ranking.