The sandbox ladder is the set of isolation tiers around Claude Code. /sandbox (Seatbelt on macOS, bubblewrap on Linux/WSL2) wraps Bash and its children at the OS level and cut permission prompts ~84% in Anthropic’s measurements - but Read, Edit, MCP, and hooks stay on the host until you climb higher.
| Approach | What is isolated | When |
|---|---|---|
Sandboxed Bash (/sandbox) | Bash + children only | Everyday local work |
@anthropic-ai/sandbox-runtime | Whole Claude process | Unattended runs; untrusted MCP |
| Dev / custom container | Full environment | Team standard; skip-permissions with firewall |
| VM | Full OS separation | Untrusted repos; compliance |
| Claude Code on the web | Anthropic-managed VM | No local setup |
Scope gap
| Mechanism | Bash children | Read / Edit | MCP / hooks |
|---|---|---|---|
| Permission rules | Pattern-matched | Yes | Yes (per tool) |
/sandbox | Yes (OS) | No | No |
| Runtime / container / VM | Yes | Yes (inside boundary) | Yes |
Defaults under /sandbox: write to working directory + session $TMPDIR; read nearly the whole machine (including ~/.aws and ~/.ssh unless denied); no network domains pre-allowed. Close the credential hole with sandbox.credentials and matching permissions.deny for Read(~/.ssh/**) and Read(./.env*). --dangerously-skip-permissions needs a container, VM, or sandbox-runtime - Bash sandbox alone is not that boundary.
Full playbook: Claude Code security in 2026. Pair with permission rules and the read/mutate split.