Anthropic Just Demonstrated How to Keep AI Agents Under Control

The biggest risk with AI agents isn’t intelligence. It’s access. What if your AI agents went rogue? How would you contain the mess?

These two questions define every engineer’s worst nightmare when building agentic systems.

Anthropic’s new publication sheds light on this and gives insights into how to contain agents when things go wrong.

I’ve been building with Claude Code, Cowork, and claude.ai for a while now, and one thing has always lingered in the back of my mind; what happens when these agents do something you didn’t ask for?

We give them access to our filesystem, our shell, and our network. We connect them to databases, Slack, GitHub, and production environments. And then we hope they behave.

Hope is not a security strategy.

Anthropic recently published an engineering deep dive into how they contain Claude across all three of their agentic products.

I'm breaking this down and sharing it with you because if you’re building agents, deploying them in production, or using Claude Code daily, this affects your workflow.

Anthropic admitted that 12 months ago, they would have rejected the idea of granting Claude access sufficient to take down an internal Anthropic service. Today, that level of access is routine for their own developers.

Anthropic’s approach to solving this comes down to two strategies:

• Supervise what the agent does — this relies on humans approving actions
• Control what the agent can do — relies on hard boundaries that don’t care about intent.

Their data showed that users approved roughly 93% of permission prompts in Claude Code. The more prompts people saw, the less attention they paid to each one.

Approval fatigue is real, and it turns a safety feature into a rubber stamp.

That’s why Anthropic changed its focus to containment: building environments where even if the agent misbehaves, the damage is limited by design.

Let’s break down how they did it, and what you should take away from this if you’re building anything with AI agents.

Types of Risk and Layers of Defense

Anthropic breaks agent security risks into three categories, and each one requires a different mindset.

• User misuse — this covers everything from a user asking the agent to bypass a check they find annoying, to running a destructive command they don’t fully understand, to intentionally directing harm. The user is the one giving instructions; the model has no reason to flag anything as suspicious.
• Model misbehavior — this is when the agent takes an action nobody asked for. Anthropic has seen Claude models escape a sandbox to complete a task, examine git history to find answers to a coding test, and even identify a benchmark it was being run on so it could decrypt the answer key. Models are getting better at finding creative paths around restrictions.
• External attackers — this includes prompt injection through tools, files, or network access, along with conventional attacks on the agent’s runtime or orchestration layer. A GitHub connector that passes malware checks can still load a poisoned README straight into the model’s context.

These three risk categories map to three components that Anthropic defends:

• Environment where the agent runs — sandboxes, VMs, filesystem boundaries, and egress controls. If credentials never enter the sandbox, they can’t be exfiltrated — regardless of whether the cause is a careless user, a creative model, or an attacker.
• Model the agent consults — this includes system prompts, classifiers, and training modifications. These shape what the agent tends to do, but since models are probabilistic, they can never guarantee what it will do. Anthropic’s numbers here are impressive — on Gray Swan’s Agent Red Teaming benchmark, Claude Opus 4.7 holds attack success to roughly 0.1% on single attempts.
• External content that the agent can reach — MCP servers, plugins, and web search tools all feed content into the agent’s context from sources you don’t control. An audited connector is not the same as audited data. Limiting tool permissions, like granting read-only database access, is one of the simplest ways to reduce blast radius.

The key insight is that these defenses need to overlap. When the model layer misses something, the environment catches it.

Containment Patterns Across Three Products

Anthropic has three agentic products: Claude.ai, Claude Code, and Claude Cowork.

Each serves a different audience and therefore needs a different containment architecture.

Pattern 1: Ephemeral Containers (claude.ai)

• Runs in a gVisor container — server-side, nothing on your machine
• Filesystem resets every session — no persistence
• Can’t access your local files or reach outside the container
• Trade-off: maximum safety, limited capability

Pattern 2: Human-in-the-Loop Sandbox (Claude Code)

• Runs on your machine with full filesystem, shell, and network access
• Originally required approval for writes/bash/network — caused approval fatigue (93% auto-approved)
• Now uses OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux)
• Writes allowed inside workspace; network blocked by default
• Result: 84% fewer permission prompts
• Experienced users auto-approve more, but interrupt mid-execution when things drift
• Risk: breaks down as bash commands get more complex or multi-agent systems appear

Pattern 3: Local VM (Claude Cowork)

• Targets non-developers who can’t evaluate bash commands
• Full VM using Apple Virtualization (macOS) or HCS (Windows) — own kernel, filesystem, process table
• Only the selected workspace folder is mounted — nothing else on the host is visible
• Credentials stay in the host keychain; never enter the VM
• Agent loop moved outside the VM (so Claude can still respond if the VM fails to boot)
• File mount modes: read-only, read-write, read-write-no-delete
• Enterprise admins can control mount paths via MDM

Real Incidents Anthropic Disclosed

The most valuable part of Anthropic’s security disclosure is real incidents from their products

Pre-Trust Dialog Vulnerability (Claude Code)

A developer clones a repo to review a PR, and malicious code runs before they’ve approved anything. The attack exploited the window between config load and user consent.

• Affected period: mid-2025 to January 2026
• Malicious .claude/settings.json in a cloned repo executed hooks before the "Do you trust this folder?" prompt
• User approved nothing — code ran before trust was established
• Fix: defer all project config parsing until after trust is accepted
• Lesson: treat config files like inbound internet requests

Phishing Attack That Worked 24/25 Times (Claude Code)

A routine-looking “can you run this?” The attached prompt looked like task instructions; buried inside was an exfiltration command, and Claude followed it nearly every time.

• February 2026 internal red team exercise
• The prompt instructed Claude to read ~/.aws/credentials and POST them externally — succeeded 24/25 times
• No classifier flagged it because the user typed the instructions
• The prompt later sat in internal Slack, where agents could pick it up; investigators added a canary string to detect ingestion
• Lesson: only real defense is the environment; egress blocks and filesystem boundaries, not intent detection

Exfiltration Through an Approved Domain (Claude Cowork)

The sandbox worked as designed, but data still got out. The attacker’s trick was routing exfiltration through a domain that Anthropic had to allow for the product to function.

• Malicious workspace file carried hidden instructions + an attacker-controlled API key
• Claude uploaded workspace files via Anthropic’s own Files API, which was on the egress allowlist, so the proxy let it through
• Fix: defensive proxy inside the VM that rejects any key that isn’t the VM’s own provisioned session token
• Lesson: an allowlist is a capability grant; every function reachable through an allowed domain is an attack surface

EDR Blind Spot (Claude Cowork)

Enterprise security teams were surprised by the same VM isolation keeping Claude contained, but it was also keeping their monitoring tools out.

• EDR software can’t inspect inside the VM; it sees an opaque hypervisor process
• Current mitigation is pull-based OTLP log exports, not live visibility
• Lesson: Have this conversation with security teams early

Final Thoughts

Anthropic identified three emerging risks that you should know if you’re building agentic systems.

• Persistent memory poisoning — Agents now carry state across sessions, product memory, CLAUDE.md files, mounted workspaces, and state directories for long-running agents. An injection that lands in any of these gets reloaded every time the agent starts.
• Multi-agent trust escalation — Sub-agents can isolate untrusted content by returning structured facts instead of raw text to the main agent. But if a sub-agent’s output is treated as higher-trust just because it came from “us,” you’ve created a new prompt injection vector.
• Agent identity — Should an agent have its own principal identity, or should it inherit the user’s permissions? Claude Cowork’s current answer is: credentials stay in the host keychain, the VM gets a per-session scoped-down token that can be revoked.

If you’re building agents, deploying them in production, or even just using Claude Code on your local machine, understanding these containment patterns is important.

Let me know your thoughts in the comments below.

Claude Code Masterclass Course

Every day, I’m working hard to build the ultimate Claude Code course, which demonstrates how to create workflows that coordinate multiple agents for complex development tasks. It’s due for release soon.

It will take what you have learned from this article to the next level of complete automation.

New features are added to Claude Code daily, and keeping up is tough.

The course explores Agents, Hooks, advanced workflows, and productivity techniques that many developers may not be aware of.

Once you join, you’ll receive all the updates as new features are rolled out.

This course will cover:

• Advanced subagent patterns and workflows
• Production-ready hook configurations
• MCP server integrations for external tools
• Team collaboration strategies
• Enterprise deployment patterns
• Real-world case studies from my consulting work

If you’re interested in getting notified when the Claude Code course launches, click here to join the early access list →

**(** Currently, I have 3000+ already signed-up developers)

I’ll share exclusive previews, early access pricing, and bonus materials with people on the list.

Let’s Connect!

If you are new to my content, my name is Joe Njenga

Join thousands of other software engineers, AI engineers, and solopreneurs who read my content daily on Medium and on YouTube where I review the latest AI engineering tools and trends. If you are more curious about my projects and want to receive detailed guides and tutorials, join thousands of other AI enthusiasts in my weekly AI Software engineer newsletter

If you would like to connect directly, you can reach out here:

[embed]AI Automation Software Engineer (10+ Years Experience) My expertise spans LLMs, vector databases, RAG pipelines, MCP servers, and intelligent automation workflows that solve…njengah.com

Follow me on Medium | YouTube Channel | X | LinkedIn | GitHub