Anthropic’s open-source sandbox-runtime provides lightweight, OS-level security for AI agents and CLI tools, restricting file and network access without the overhead of containers.
AI-generated summary. Check the original reporting for context and accuracy.
This is the available feed excerpt, which may be shortened or in the publisher’s original language.
In this article, we will discuss newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool. The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code. Your own agents, local MCP servers and plain command-line programs can run inside it. TL;DR Size: npm package @anthropic-ai/sandbox-runtime v0.0.81, about 11.4 MB unpacked, Apache-2.0, Node.js 22.12+. Runs on: any macOS or Linux dev machine or CI box. macOS uses Seatbelt; Linux needs bubblewrap, socat and ripgrep. Windows is alpha. Performance: sandboxing cut Claude Code permission prompts by 84% in Anthropic’s internal usage (self-reported). Best: 84% fewer permission prompts, with file and network limits enforced on the whole process tree. Worst: still a beta research preview, Windows support is alpha. What is Anthropic sandbox-runtime? Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It works as a CLI and as a TypeScript library. How does sandbox-runtime work on macOS, Linux and Windows? srt uses each operating system’s own isolation primitives. Its restrictions cover the entire process tree, including scripts and subprocesses. macOS: sandbox-exec with dynamically generated Seatbelt profiles. Only ripgrep is required. Linux: bubblewrap with the network namespace removed. It also needs socat and ripgrep. Windows (alpha): a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs. Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux, those proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile allows only one localhost port. The proxies then apply your d
An automated sorting aid based on source trust, keywords, and entities, on a scale of 1–12. High: 9–12; medium: 6–8; low: 1–5. It does not measure urgency, verify reporting, or indicate editorial endorsement.
This tutorial demonstrates building a stateful engineering copilot using Letta to enable autonomous memory management, shared agent state, and semantic retrieval for advanced AI workflows.
NVIDIA’s new 4GB open model enables fast, local voice agents and game characters on consumer hardware, freeing up resources for other AI tasks.
Kyutai’s CADRE autoencoders reduce world model latency to under 230 ms, enabling faster, more responsive interactive simulations on a single H100 GPU.