Anthropic releases sandbox-runtime, the tool that isolates its AI agents

Anthropic has open-sourced sandbox-runtime, a tool known as srt that restricts what AI agents, MCP servers and command-line tools are allowed to touch on a computer. According to MarkTechPost, it is the same sandbox that already runs inside Claude Code, Anthropic’s coding tool, and is now released for anyone to use.

The tool limits file and network access without relying on containers, the software boxes that bundle an application with its own copy of an operating system to keep it separate from the rest of a machine. Instead, srt works directly with features already built into the operating system: Seatbelt, Apple’s process-restriction system, on macOS, and bubblewrap, a lightweight sandboxing tool, on Linux. Because it uses tools the operating system already provides, MarkTechPost reports it can sandbox a process without the setup or overhead that containers usually require.

Why agents need a sandbox

AI agents increasingly run with direct access to a user’s files, shell and network connection so they can edit code, call external services or run commands on their own. MCP servers, which are tools that let AI models connect to outside services and data, extend that same access further. If an agent misreads an instruction, follows a bad prompt, or a connected tool misbehaves, that access can turn into deleted files, leaked data or unwanted network calls. A sandbox narrows what the agent can reach even when something goes wrong, which is the stated purpose of restricting file and network access in srt.

MarkTechPost’s description frames sandbox-runtime as infrastructure for running agents safely in production, not just as a safety net for testing. By building on OS-level restrictions rather than containers, the tool is positioned as something that can sit in front of an agent, an MCP server or a CLI tool with less setup than a full containerized environment would need.

The source material does not specify which license sandbox-runtime is released under, where its code repository is hosted, which specific macOS and Linux versions it supports, or whether Anthropic has published benchmarks comparing it to container-based sandboxing. It also does not say whether sandbox-runtime is meant to replace container-based isolation entirely or to complement it for agents that need lighter-weight restrictions. Those details are not available in the reporting reviewed here.

What to watch next is whether developers building agents outside Claude Code adopt sandbox-runtime for their own tools, and whether Anthropic follows the release with documentation, benchmarks or guidance on how srt compares to container-based approaches for running agents in production.