# Simon Willison on Anthropic's Containment Architecture for Claude — gVisor for Claude.ai, Seatbelt and Bubblewrap for Claude Code, Full VMs for Cowork

> Simon Willison breaks down Anthropic's three-tier sandbox stack for Claude.ai, Claude Code, and Claude Cowork, including a red-team exfiltration story.

- Org: Simon Willison
- Date: 2026-05-30
- Category: article, security
- Source: https://simonwillison.net/2026/May/30/how-we-contain-claude/
- Canonical page: https://ai-tldr.dev/releases/simonw-how-we-contain-claude/

## In short

Simon Willison highlights Anthropic's engineering writeup detailing how each Claude product is sandboxed: gVisor on Claude.ai, Seatbelt or Bubblewrap on Claude Code, and full VMs for Claude Cowork, plus a documented exfiltration red-team incident.

## What it is

A link post on simonwillison.net pointing at Anthropic's engineering writeup 'How we contain Claude across products' by Max McGuinness, Mikaela Grace, Jiri De Jonghe, Jake Eaton, and Abel Ribbink. Willison flags it as the kind of public security documentation that AI tooling vendors usually keep behind closed doors.

## How it works

The Anthropic post Willison summarizes describes three layered containment patterns. Claude.ai runs each session inside an ephemeral gVisor container on Anthropic infrastructure with no local code execution. Claude Code runs locally with a host-level sandbox — Seatbelt on macOS, Bubblewrap on Linux — gated by per-action permission dialogs. Claude Cowork runs a full virtual machine, using Apple's Virtualization framework on macOS and HCS on Windows. The post also walks through a February 2026 internal red-team exercise in which a phished employee triggered Claude Code into reading ~/.aws/credentials and POSTing them to an external endpoint, with the agent completing exfiltration 24 of 25 times.

## Why it matters

Most agent vendors won't say what isolation layer separates a tool call from your filesystem. Willison's amplification puts Anthropic's three patterns — and the failure mode they had to fix — in front of the developer audience deciding what to deploy in production. It also gives security teams a concrete frame for evaluating other agent platforms.

## Who it's for

security engineers, platform teams, and developers shipping agentic tools

## Try it

https://www.anthropic.com/engineering/how-we-contain-claude

## Links

- [Simon's Post](https://simonwillison.net/2026/May/30/how-we-contain-claude/)
- [Anthropic Writeup](https://www.anthropic.com/engineering/how-we-contain-claude)
- [Simon's Weblog](https://simonwillison.net/)