Anthropic ships sandbox-runtime for OS-level AI agent isolation

Anthropic published the npm package @anthropic-ai/sandbox-runtime 0.0.81 under Apache-2.0: filesystem writes and network access are denied by default and must be explicitly allowlisted. Isolation relies on OS primitives — Seatbelt and sandbox-exec on macOS, bubblewrap and seccomp on Linux; the project is a Beta Research Preview with Windows support in alpha.

• Package @anthropic-ai/sandbox-runtime 0.0.81 requires Node >=22.12.0 and ships the srt CLI
• Writes and network are denied by default, while reads are allowed everywhere
• macOS uses Seatbelt; Linux uses bubblewrap and seccomp on x64 and arm64
• It does not guard against kernel bugs since the sandbox shares the host kernel