Author(s): Hubert Nakielski

Originally published on Towards AI.

Seatbelt, a hardened container, Docker Sandboxes, gVisor and Firecracker against the same canary: how to set each one up, what it stopped, and why only the credentials hole stayed open in all five.

In a February 2026 red-team exercise at Anthropic, a phished employee launched Claude Code with a prompt that read ~/.aws/credentials and posted them out, and Claude completed the exfiltration 24 times out of 25. Anthropic's write-up says only the environment holds against that: egress controls that block the POST, and filesystem boundaries that keep ~/.aws out of reach. So I ran a fake version of that agent bare, then through five boxes on my M3 Mac. Each setup is below. My verdict up front: on a laptop, what you let through matters more than which box you pick.

The article compares five isolation approaches—bare execution, a macOS process sandbox (srt/Seatbelt), hardened Docker containers, Docker Sandboxes (microVMs on Apple Hypervisor.framework), and (optionally) gVisor and Firecracker inside a nested Lima VM—by running the same “canary” payload that attempts to read fake AWS-like credentials, write a malicious git hook, delete files outside the workdir, and exfiltrate a token over allowed and disallowed network endpoints. Across most configurations, filesystem and egress controls stop the intended file and network probes when the relevant paths and destinations aren’t mounted or allowlisted, but the token exfiltration and host git-hook landing often succeed because the sandbox still receives the token via the environment and mounts the project (or otherwise gives a writable path), and Claude Code’s proxy decides hostnames without inspecting TLS. The author concludes that “close the holes first” (avoid credential exposure, restrict mounts, and treat every allowlisted host as an egress path) matters more than which sandbox technology is chosen, and notes practical limitations (sandbox defaults, incomplete coverage like git hooks/MCP/local servers, and mismatches between vendor specs and real performance due to snapshots and nesting costs).

Read the full blog for free on Medium.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI