Anthropic Engineering · 2024

How We Contain Claude

A comprehensive analysis of the defense-in-depth containment architecture Anthropic uses to constrain Claude's capabilities across deployment contexts — from ephemeral containers to full VM isolation.

Authors

MM
Anthropic Engineer
MG
Anthropic Engineer
JD
Applied AI, Anthropic
JE
Writer, Anthropic
AR
Anthropic Engineer

Containment Patterns

Ephemeral Container claude.ai

Single-turn interactions without persistent state. Isolated via container boundaries with no network egress and minimal syscall surface.

gVisorseccompNo network egressRead-only FS
HITL + OS Sandbox Claude Code

Human-in-the-loop with OS-level sandboxing for agentic workflows. Supports persistent sessions with selective file-system access and controlled process execution.

macOS sandboxseccomp-BPFHITL approvalAudit logging
Full VM Isolation Cowork

Complete virtual machine per session for maximum isolation. Supports complex multi-step workflows with full OS access within the VM boundary.

Full VMHypervisor filteringSession isolationOpenTelemetry

Knowledge Graph Explorer

Interactive force-directed graph of entities and relationships extracted from the article. Click the SVG to activate zoom/pan; click outside to release.

20 nodes · 24 links
Click graph to activate zoom · Click outside to release

Frequently Asked Questions

Glossary

HowTo: Secure Agentic AI Deployment

SPARQL Explorer

Query the Knowledge Graph for this article. Runs a canonical entity-type summary query against the live Named Graph on URIBurner.

Run Entity-Type Query ↗
Named Graph: https://linkeddata.uriburner.com/DAV/demos/daas/how-we-contain-claude-anthropic_sonnet4-1.ttl