The permission asks are the slowest part of Claude Code. That's why the first thing I was looking for was --dangerously-skip-permissions, it was a breaking moment for me but also a new risk. My first thought was what if it does read my private keys from ~/.ssh? What if it accesses my other projects or sensitive resources shared by my clients? One wrong action and it can remove not relevant files. What's even worse for me - it will install python libs used for the dev session and flood my Mac with that, it's terrible for people like me who love to keep the workstation clean!
I'm letting Claude Code to work for hours or even night without me around, the permissions prompt issue was solved by the flag but how not to risk my Mac and confidential files? After reading Anthropics docs I have found it's pointing to the containers direction, VMs or sandboxes. Ok but which one? What are the differences? That's the overview for September 2026 as I'm writing this.
The mental model, rate each answer with a short question: what are the boundaries of the agent inside? Two biggest problems I've noticed are making the biggest damage. Leak of our sensitive/confidential data and the unrecoverable removal. Breaking the kernel isolation is real but rare and almost never happens during a day-to-day work, it has to be intentional. Keys leaks are normal these days and happens all the time. So what really matters is the boundary between your agent and your data, not between your agent and the virtualization kernel.
