Anthropic's Three-Layer Containment Pattern for Claude Agents: Contain the Environment Before Steering the Model
A practical write-up of the agent containment setup Anthropic runs for Claude: why approval prompts failed, how the environment, model, and external layers work
The original author is Yarchi (@undefinedKi) on X, and this piece faithfully renders his thread summarizing Anthropic Engineering's "How we contain Claude" for an English-speaking reader. Figures and setups below are as reported in that thread, not direct quotations from the Anthropic original.
Illustration for this article (referencing the Yarchi thread and the Anthropic Engineering original)
The core claim, as summarized by the original author: supervising agents with approval prompts broke down first. Users clicked "yes" on 93% of approval prompts, so Anthropic shifted from supervising the agent to containing it.
Three Layers: Environment, Model, External
Every agent sits inside three layers:
- Environment: sandboxes, VMs, egress rules. The hard ceiling. Even when the agent makes a bad choice, this layer physically limits what it can reach.
- Model: prompts, classifiers, training. Shapes what the agent tends to do. This layer adjusts the agent's behavioral tendencies.
- External: MCP servers, plugins, web. Audit what goes in and out. This layer inspects what enters from outside and what leaves.
The one rule the original author says he would steal first: contain the environment first, steer the model second.
One Setup per Product: Chat, Code, and Cowork Differ
Each product gets its own containment pattern, as reported by the thread author from the original piece:
- Claude Chat: a throwaway container per session. An isolation unit discarded when the session ends.
- Claude Code: OS sandbox, network off by default. The author reports 84% fewer permission prompts under this setup.
- Cowork: a local VM, only the workspace mounted, credentials stay on the host. Credentials never touch the agent's environment — the detail commenter @talemi singled out as the one worth stealing.
Caveat to Carry Over
A caveat from the thread's replies is worth preserving. As @HavisT83099 pointed out, if an MCP server can pull arbitrary web content into context, the sandbox caps what the agent can do but not what it reads. Read that as: pair sandboxing with external-layer auditing and egress rules.
For practice, the order is simple. Fence in the directories and network ranges the agent can touch first, then refine prompts and permissions. Adding more approval popups is not the answer — the 93% figure is the whole argument.
Original source
- Original thread by Yarchi (@undefinedKi): Anthropic published the exact agent containment setup they run for Claude
- Anthropic Engineering original: How we contain Claude