Why Claude Code Still Needs a Sandbox Even with Auto Mode

What Auto Mode Judges

Claude Code normally shows a pop‑up for every risky action. Auto Mode replaces per‑action prompts with an independent classifier that reviews each command before execution. The system has two defenses:

Prompt‑injection probe (input side) : scans tool output (file reads, web fetches, command results) before it enters the model context. If suspicious content is found, a warning token is injected so the model stays skeptical of that content.

Action classifier (output side) : each pending tool command passes a fast token‑level filter; commands flagged by the filter undergo a second‑stage review with full reasoning. The classifier only sees the user message and the raw tool command – the model’s own explanation is stripped to prevent the model from persuading the classifier.

The default blocklist includes piped curl execution, outbound transmission of sensitive data, production deployments, force‑pushes, and writing credentials to files. The classifier’s trust scope is defined: the initial working directory and any Git remote configured at session start are considered trusted; remotes added later are treated as external infrastructure. The core question the classifier asks is whether the action exceeds the user‑granted scope for the current request.

Why Auto Mode Alone Is Not Sufficient

Anthropic measured that about 93 % of permission dialogs were auto‑approved , indicating severe approval fatigue. In a curated set of 52 real over‑privilege incidents, the Auto Mode classifier missed 17 % (roughly one in six dangerous actions). A separate test on 10 000 internal tool calls showed a false‑positive rate of 0.4 % , confirming low friction for legitimate work. In an internal red‑team exercise (February 2026), credential‑leaking commands succeeded in 24 of 25 attempts when the malicious instruction originated directly from user input. Anthropic explained that the model‑layer defense focuses on user intent; when the user explicitly types the command, the classifier finds no anomaly.

What the Sandbox Actually Blocks

The sandbox enforces OS‑level primitives rather than intent judgments. On macOS it uses the built‑in Seatbelt sandbox; on Linux and WSL2 it uses bubblewrap together with socat . All processes spawned by a command and their children are confined to a single boundary. By default the sandbox permits writes only to the current working directory and temporary session directories. The first outbound network connection must pass through an external proxy that requires explicit approval. Limitations disclosed by Anthropic include: TLS traffic is not decrypted by default, so allowing a wide domain can be abused via domain‑fronting. Credential files are readable unless a separate credential‑protection configuration is applied. If a command cannot run inside the sandbox, Claude can retry it with an explicit flag that runs the command outside the sandbox. In Auto Mode this retry is sent back to the classifier for a second judgment, so the two layers back‑stop each other. Permission Rules vs. Prompts A natural‑language reminder placed in CLAUDE.md is merely context for the model; it can be forgotten, overridden, or hidden by injected content. By contrast, a permissions.deny rule is a machine‑matched policy that applies in every permission mode, including bypassPermissions . The rule is evaluated before the classifier and therefore cannot be persuaded by model reasoning. Four‑Layer Cumulative Defense The defenses stack as follows: Permission rules (string‑matching allow/deny) lock down known actions. Auto Mode classifier filters the majority of everyday commands; Anthropic reports it blocks about 83 % of over‑privilege attempts before execution. Sandbox enforces filesystem and network boundaries at runtime, preventing any missed command from affecting resources outside its confined area. Human ask rules trigger a pop‑up for high‑cost actions, ensuring a final human decision for the most critical operations. In practice, Auto Mode reduces low‑value clicks, while the sandbox guarantees that any command that slips past the classifier cannot exceed the confined filesystem or network scope, thereby containing potential escalation.