Anthropic has rolled out a local Bash sandbox mode for Claude Code on desktop, giving the AI coding tool a security upgrade that isolates command execution at the operating system level. The feature works on macOS and Linux/WSL2, using native sandboxing technologies to restrict what Claude Code can actually touch on your machine.
How the sandbox actually works
The technical implementation varies by platform. On macOS, the sandbox relies on Seatbelt, Apple’s built-in sandboxing framework that enforces fine-grained restrictions on process-level access. Linux and WSL2 users get bubblewrap, a lightweight containerization tool commonly used in the Linux ecosystem for unprivileged sandboxing.
Both approaches accomplish the same goal: filesystem access gets locked down to the current working directory and its children, while network requests pass through a proxy layer that only permits connections to pre-approved domains.
Windows users, for now, are left out. Full native support for Windows remains absent.
