What happened
On Oct 24 Anthropic released sandbox-runtime (npm @anthropic-ai/sandbox-runtime, Apache-2.0), the OS-level confinement layer behind Claude Code's sandboxed bash tool, as a general-purpose CLI + TypeScript library usable with any agent, MCP server, or command-line program. It applies Seatbelt (macOS), bubblewrap (Linux) or a Windows WFP+account fence (alpha) to the whole process tree, with network deny-by-default and domain allowlist proxies; Anthropic reports it cut Claude Code permission prompts ~84% internally.
Why it matters
This is a significant vendor shipping the containment primitive for the agent era, and by open-sourcing it as a standalone tool it makes OS-level filesystem+network isolation reproducible by any team, not just Claude Code users. It directly addresses prompt-injection exfiltration and approval-fatigue, and lands in the same week as rival sandboxes from NVIDIA/Perplexity — a signal of consolidation around OS-primitive isolation over microVMs.
Applicability
Platform/SecOps teams running coding agents or MCP servers on developer or CI machines should evaluate it as a lightweight alternative to container/microVM sandboxing; start log-only, then harden the domain allowlist.