超越权限提示：让 Claude Code 更安全、更自主
Beyond permission prompts: making Claude Code more secure and autonomous
InClaude Code, Claude writes, tests, and debugs code alongside you, navigating your codebase, editing multiple files, and running commands to verify its work. Giving Claude this much access to your codebase and files can introduce risks, especially in the case of prompt injection. To help address this, we’ve introduced two new features in Claude Code built on top of sandboxing, both of which are designed to provide a more secure place for developers to work, while also allowing Claude to run more autonomously and with fewer permission prompts. In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%. By defining set boundaries within which Claude can work freely, they increase security and agency.
在 Claude Code 中，Claude 与你一起编写、测试和调试代码，浏览你的代码库、编辑多个文件，并运行命令来验证其工作成果。赋予 Claude 对代码库和文件的广泛访问权限可能会带来风险，尤其是在提示注入（Prompt Injection）的情况下。 为了解决这个问题，我们在 Claude Code 中基于沙箱化（Sandboxing）机制引入了两项新功能，旨在为开发者提供更安全的工作环境，同时让 Claude 能够更自主地运行，减少权限提示的次数。在我们的内部使用中，沙箱化安全地将权限提示减少了 84%。通过定义明确的边界，让 Claude 在边界内自由工作，既提升了安全性，也增强了自主性。
Keeping users secure on Claude Code
保障 Claude Code 用户的安全
Claude Code runs on a permission-based model: by default, it's read-only, which means it asks for permission before making modifications or running any commands. There are some exceptions to this: we auto-allow safe commands like echo or cat, but most operations still need explicit approval. Constantly clicking "approve" slows down development cycles and can lead to ‘approval fatigue’, where users might not pay close attention to what they're approving, and in turn making development less safe. To address this, we launched sandboxing for Claude Code.
Claude Code 采用基于权限的模型：默认情况下为只读模式，这意味着它在进行修改或运行任何命令之前会请求许可。有一些例外情况：我们会自动允许像 echo 或 cat 这样的安全命令，但大多数操作仍然需要明确批准。
不断点击"批准"会拖慢开发节奏，并可能导致"审批疲劳"——用户可能不会仔细审查他们正在批准的内容，从而降低开发安全性。
为了解决这个问题，我们为 Claude Code 推出了沙箱化功能。
Sandboxing: a safer and more autonomous approach
沙箱化：更安全、更自主的方式
Sandboxing creates pre-defined boundaries within which Claude can work more freely, instead of asking for permission for each action. With sandboxing enabled, you get drastically fewer permission prompts and increased safety. Our approach to sandboxing is built on top of operating system-level features to enable two boundaries:
沙箱化创建了预定义的边界，让 Claude 可以在其中更自由地工作，而不是为每个操作都请求许可。启用沙箱化后，权限提示会大幅减少，安全性也会显著提升。 我们的沙箱化方案基于操作系统级特性，构建了两个边界：
- Filesystem isolation,which ensures that Claude can only access or modify specific directories. This is particularly important in preventing a prompt-injected Claude from modifying sensitive system files.
- Network isolation,which ensures that Claude can only connect to approved servers. This prevents a prompt-injected Claude from leaking sensitive information or downloading malware.
- 文件系统隔离（Filesystem Isolation），确保 Claude 只能访问或修改特定目录。这对于防止被提示注入的 Claude 修改敏感系统文件尤为重要。
- 网络隔离（Network Isolation），确保 Claude 只能连接到已批准的服务器。这可以防止被提示注入的 Claude 泄露敏感信息或下载恶意软件。
It is worth noting that effective sandboxing requiresbothfilesystem and network isolation. Without network isolation, a compromised agent could exfiltrate sensitive files like SSH keys; without filesystem isolation, a compromised agent could easily escape the sandbox and gain network access. It’s by using both techniques that we can provide a safer and faster agentic experience for Claude Code users.
值得注意的是，有效的沙箱化需要同时具备文件系统隔离和网络隔离。缺少网络隔离，被攻破的智能体（Agent）可以窃取 SSH 密钥等敏感文件；缺少文件系统隔离，被攻破的智能体可以轻松逃逸沙箱并获得网络访问权限。只有同时使用这两种技术，我们才能为 Claude Code 用户提供更安全、更快速的智能体体验。
Two new sandboxing features in Claude Code
Claude Code 的两项新沙箱化功能
Sandboxed bash tool: safe bash execution without permission prompts
沙箱化 bash 工具：无需权限提示的安全 bash 执行
We're introducinga new sandbox runtime, available in beta as a research preview, that lets you define exactly which directories and network hosts your agent can access, without the overhead of spinning up and managing a container. This can be used to sandbox arbitrary processes, agents and MCP servers. It is also available asan open source research preview. In Claude Code, we use this runtime to sandbox the bash tool, which allows Claude to run commands within the defined limits you set. Inside the safe sandbox, Claude can run more autonomously and safely execute commands without permission prompts. If Claude tries to access somethingoutsideof the sandbox, you'll be notified immediately, and can choose whether or not to allow it. We’ve built this on top of OS level primitives such asLinux bubblewrapand MacOS seatbelt to enforce these restrictions at the OS level. They cover not just Claude Code's direct interactions, but also any scripts, programs, or subprocesses that are spawned by the command.As described above, this sandbox enforces both:
我们引入了一个新的沙箱运行时，作为研究预览版提供测试，它允许你精确定义智能体可以访问哪些目录和网络主机，而无需承担启动和管理容器的开销。它可用于对任意进程、智能体和 MCP 服务器进行沙箱化。同时，它也作为开源研究预览版发布。 在 Claude Code 中，我们使用该运行时来沙箱化 bash 工具，使 Claude 能够在你设定的限定范围内运行命令。在安全沙箱内，Claude 可以更自主地运行，无需权限提示即可安全执行命令。如果 Claude 尝试访问沙箱之外的内容，你会立即收到通知，并可以选择是否允许。 我们在操作系统级原语之上构建了这一功能，例如 Linux 的 bubblewrap 和 macOS 的 seatbelt，以在操作系统层面强制执行这些限制。它们不仅覆盖 Claude Code 的直接交互，还涵盖命令生成的任何脚本、程序或子进程。如上所述，该沙箱同时强制执行：
- Filesystem isolation,by allowing read and write access to the current working directory, but blocking the modification of any files outside of it.
- Network isolation,by only allowing internet access through a unix domain socket connected to a proxy server running outside the sandbox. This proxy server enforces restrictions on the domains that a process can connect to, and handles user confirmation for newly requested domains. And if you’d like further-increased security, we also support customizing this proxy to enforce arbitrary rules on outgoing traffic.
- 文件系统隔离，允许读写访问当前工作目录，但阻止修改目录外的任何文件。
- 网络隔离，仅允许通过连接到沙箱外部代理服务器的 Unix 域套接字（Unix Domain Socket）访问互联网。该代理服务器对进程可连接的域名实施限制，并处理新请求域名的用户确认。如果你需要进一步增强安全性，我们还支持自定义该代理，对出站流量执行任意规则。
Both components are configurable: you can easily choose to allow or disallow specific file paths or domains. Sandboxing ensures that even a successful prompt injection is fully isolated, and cannot impact overall user security. This way, a compromised Claude Code can't steal your SSH keys, or phone home to an attacker's server. To get started with this feature, run /sandbox in Claude Code and check outmore technical detailsabout our security model. To make it easier for other teams to build safer agents, we haveopen sourcedthis feature. We believe that others should consider adopting this technology for their own agents in order to enhance the security posture of their agents.
两个组件均可配置：你可以轻松选择允许或禁止特定文件路径或域名。
沙箱化确保即使提示注入成功，攻击也被完全隔离，不会影响用户的整体安全。这样，被攻破的 Claude Code 无法窃取你的 SSH 密钥，也无法向攻击者的服务器回传数据。
要开始使用此功能，请在 Claude Code 中运行 /sandbox，并查看我们安全模型的更多技术细节。
为了帮助其他团队更容易地构建更安全的智能体，我们已将此功能开源。我们建议其他团队考虑为自己的智能体采用这项技术，以增强其安全态势。
Claude Code on the web: running Claude Code securely in the cloud
网页版 Claude Code：在云端安全运行 Claude Code
Today, we're also releasingClaude Code on the webenabling users to run Claude Code in an isolated sandbox in the cloud. Claude Code on the web executes each Claude Code session in an isolated sandbox where it has full access to its server in a safe and secure way. We've designed this sandbox to ensure that sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code. This way, even if the code running in the sandbox is compromised, the user is kept safe from further harm. Claude Code on the web uses a custom proxy service that transparently handles all git interactions. Inside the sandbox, the git client authenticates to this service with a custom-built scoped credential. The proxy verifies this credential and the contents of the git interaction (e.g. ensuring it is only pushing to the configured branch), then attaches the right authentication token before sending the request to GitHub.
今天，我们还发布了网页版 Claude Code（Claude Code on the web），使用户能够在云端的隔离沙箱中运行 Claude Code。网页版 Claude Code 在隔离沙箱中执行每个 Claude Code 会话，让 Claude 可以安全地完全访问其服务器。我们设计该沙箱的目的是确保敏感凭据（如 git 凭据或签名密钥）永远不会与 Claude Code 一起存放在沙箱内。这样，即使沙箱中运行的代码被攻破，用户也能免受进一步的损害。 网页版 Claude Code 使用自定义代理服务透明地处理所有 git 交互。在沙箱内部，git 客户端使用自定义构建的范围化凭据（Scoped Credential）向该服务进行身份验证。代理验证该凭据和 git 交互的内容（例如确保只推送到配置的分支），然后附加正确的身份验证令牌后再将请求发送到 GitHub。
Getting started
快速开始
Our new sandboxed bash tool and Claude Code on the web offer substantial improvements in both security and productivity for developers using Claude for their engineering work. To get started with these tools:
我们新的沙箱化 bash 工具和网页版 Claude Code 为使用 Claude 进行工程开发的开发者在安全性和生产力方面都带来了显著提升。 要开始使用这些工具：
- Run
/sandboxin Claude and check outour docson how to configure this sandbox. - Go toclaude.com/codeto try out Claude Code on the web.
- 在 Claude 中运行
/sandbox，并查看我们的文档了解如何配置沙箱。 - 访问 claude.com/code 试用网页版 Claude Code。
Or, if you're building your own agents, check out ouropen-sourced sandboxing code, and consider integrating it into your work. We look forward to seeing what you build. To learn more about Claude Code on the web, check out ourlaunch blog post.
或者，如果你正在构建自己的智能体，请查看我们的开源沙箱化代码，考虑将其集成到你的工作中。我们期待看到你的成果。 要了解更多关于网页版 Claude Code 的信息，请查看我们的发布博文。
Acknowledgements
致谢
Article written by David Dworken and Oliver Weller-Davies, with contributions from Meaghan Choi, Catherine Wu, Molly Vorwerck, Alex Isken, Kier Bradwell, and Kevin Garcia
本文由 David Dworken 和 Oliver Weller-Davies 撰写，Meaghan Choi、Catherine Wu、Molly Vorwerck、Alex Isken、Kier Bradwell 和 Kevin Garcia 对本文亦有贡献。
在 Claude Code 中，Claude 与你一起编写、测试和调试代码，浏览你的代码库、编辑多个文件，并运行命令来验证其工作成果。赋予 Claude 对代码库和文件的广泛访问权限可能会带来风险，尤其是在提示注入（Prompt Injection）的情况下。 为了解决这个问题，我们在 Claude Code 中基于沙箱化（Sandboxing）机制引入了两项新功能，旨在为开发者提供更安全的工作环境，同时让 Claude 能够更自主地运行，减少权限提示的次数。在我们的内部使用中，沙箱化安全地将权限提示减少了 84%。通过定义明确的边界，让 Claude 在边界内自由工作，既提升了安全性，也增强了自主性。
保障 Claude Code 用户的安全
Claude Code 采用基于权限的模型：默认情况下为只读模式，这意味着它在进行修改或运行任何命令之前会请求许可。有一些例外情况：我们会自动允许像 echo 或 cat 这样的安全命令，但大多数操作仍然需要明确批准。
不断点击"批准"会拖慢开发节奏，并可能导致"审批疲劳"——用户可能不会仔细审查他们正在批准的内容，从而降低开发安全性。
为了解决这个问题，我们为 Claude Code 推出了沙箱化功能。
沙箱化：更安全、更自主的方式
沙箱化创建了预定义的边界，让 Claude 可以在其中更自由地工作，而不是为每个操作都请求许可。启用沙箱化后，权限提示会大幅减少，安全性也会显著提升。 我们的沙箱化方案基于操作系统级特性，构建了两个边界：
- 文件系统隔离（Filesystem Isolation），确保 Claude 只能访问或修改特定目录。这对于防止被提示注入的 Claude 修改敏感系统文件尤为重要。
- 网络隔离（Network Isolation），确保 Claude 只能连接到已批准的服务器。这可以防止被提示注入的 Claude 泄露敏感信息或下载恶意软件。
值得注意的是，有效的沙箱化需要同时具备文件系统隔离和网络隔离。缺少网络隔离，被攻破的智能体（Agent）可以窃取 SSH 密钥等敏感文件；缺少文件系统隔离，被攻破的智能体可以轻松逃逸沙箱并获得网络访问权限。只有同时使用这两种技术，我们才能为 Claude Code 用户提供更安全、更快速的智能体体验。
Claude Code 的两项新沙箱化功能
沙箱化 bash 工具：无需权限提示的安全 bash 执行
我们引入了一个新的沙箱运行时，作为研究预览版提供测试，它允许你精确定义智能体可以访问哪些目录和网络主机，而无需承担启动和管理容器的开销。它可用于对任意进程、智能体和 MCP 服务器进行沙箱化。同时，它也作为开源研究预览版发布。 在 Claude Code 中，我们使用该运行时来沙箱化 bash 工具，使 Claude 能够在你设定的限定范围内运行命令。在安全沙箱内，Claude 可以更自主地运行，无需权限提示即可安全执行命令。如果 Claude 尝试访问沙箱之外的内容，你会立即收到通知，并可以选择是否允许。 我们在操作系统级原语之上构建了这一功能，例如 Linux 的 bubblewrap 和 macOS 的 seatbelt，以在操作系统层面强制执行这些限制。它们不仅覆盖 Claude Code 的直接交互，还涵盖命令生成的任何脚本、程序或子进程。如上所述，该沙箱同时强制执行：
- 文件系统隔离，允许读写访问当前工作目录，但阻止修改目录外的任何文件。
- 网络隔离，仅允许通过连接到沙箱外部代理服务器的 Unix 域套接字（Unix Domain Socket）访问互联网。该代理服务器对进程可连接的域名实施限制，并处理新请求域名的用户确认。如果你需要进一步增强安全性，我们还支持自定义该代理，对出站流量执行任意规则。
两个组件均可配置：你可以轻松选择允许或禁止特定文件路径或域名。
沙箱化确保即使提示注入成功，攻击也被完全隔离，不会影响用户的整体安全。这样，被攻破的 Claude Code 无法窃取你的 SSH 密钥，也无法向攻击者的服务器回传数据。
要开始使用此功能，请在 Claude Code 中运行 /sandbox，并查看我们安全模型的更多技术细节。
为了帮助其他团队更容易地构建更安全的智能体，我们已将此功能开源。我们建议其他团队考虑为自己的智能体采用这项技术，以增强其安全态势。
网页版 Claude Code：在云端安全运行 Claude Code
今天，我们还发布了网页版 Claude Code（Claude Code on the web），使用户能够在云端的隔离沙箱中运行 Claude Code。网页版 Claude Code 在隔离沙箱中执行每个 Claude Code 会话，让 Claude 可以安全地完全访问其服务器。我们设计该沙箱的目的是确保敏感凭据（如 git 凭据或签名密钥）永远不会与 Claude Code 一起存放在沙箱内。这样，即使沙箱中运行的代码被攻破，用户也能免受进一步的损害。 网页版 Claude Code 使用自定义代理服务透明地处理所有 git 交互。在沙箱内部，git 客户端使用自定义构建的范围化凭据（Scoped Credential）向该服务进行身份验证。代理验证该凭据和 git 交互的内容（例如确保只推送到配置的分支），然后附加正确的身份验证令牌后再将请求发送到 GitHub。
快速开始
我们新的沙箱化 bash 工具和网页版 Claude Code 为使用 Claude 进行工程开发的开发者在安全性和生产力方面都带来了显著提升。 要开始使用这些工具：
- 在 Claude 中运行
/sandbox，并查看我们的文档了解如何配置沙箱。 - 访问 claude.com/code 试用网页版 Claude Code。
或者，如果你正在构建自己的智能体，请查看我们的开源沙箱化代码，考虑将其集成到你的工作中。我们期待看到你的成果。 要了解更多关于网页版 Claude Code 的信息，请查看我们的发布博文。
致谢
本文由 David Dworken 和 Oliver Weller-Davies 撰写，Meaghan Choi、Catherine Wu、Molly Vorwerck、Alex Isken、Kier Bradwell 和 Kevin Garcia 对本文亦有贡献。
InClaude Code, Claude writes, tests, and debugs code alongside you, navigating your codebase, editing multiple files, and running commands to verify its work. Giving Claude this much access to your codebase and files can introduce risks, especially in the case of prompt injection. To help address this, we’ve introduced two new features in Claude Code built on top of sandboxing, both of which are designed to provide a more secure place for developers to work, while also allowing Claude to run more autonomously and with fewer permission prompts. In our internal usage, we've found that sandboxing safely reduces permission prompts by 84%. By defining set boundaries within which Claude can work freely, they increase security and agency.
Keeping users secure on Claude Code
Claude Code runs on a permission-based model: by default, it's read-only, which means it asks for permission before making modifications or running any commands. There are some exceptions to this: we auto-allow safe commands like echo or cat, but most operations still need explicit approval. Constantly clicking "approve" slows down development cycles and can lead to ‘approval fatigue’, where users might not pay close attention to what they're approving, and in turn making development less safe. To address this, we launched sandboxing for Claude Code.
Sandboxing: a safer and more autonomous approach
Sandboxing creates pre-defined boundaries within which Claude can work more freely, instead of asking for permission for each action. With sandboxing enabled, you get drastically fewer permission prompts and increased safety. Our approach to sandboxing is built on top of operating system-level features to enable two boundaries:
- Filesystem isolation,which ensures that Claude can only access or modify specific directories. This is particularly important in preventing a prompt-injected Claude from modifying sensitive system files.
- Network isolation,which ensures that Claude can only connect to approved servers. This prevents a prompt-injected Claude from leaking sensitive information or downloading malware.
It is worth noting that effective sandboxing requiresbothfilesystem and network isolation. Without network isolation, a compromised agent could exfiltrate sensitive files like SSH keys; without filesystem isolation, a compromised agent could easily escape the sandbox and gain network access. It’s by using both techniques that we can provide a safer and faster agentic experience for Claude Code users.
Two new sandboxing features in Claude Code
Sandboxed bash tool: safe bash execution without permission prompts
We're introducinga new sandbox runtime, available in beta as a research preview, that lets you define exactly which directories and network hosts your agent can access, without the overhead of spinning up and managing a container. This can be used to sandbox arbitrary processes, agents and MCP servers. It is also available asan open source research preview. In Claude Code, we use this runtime to sandbox the bash tool, which allows Claude to run commands within the defined limits you set. Inside the safe sandbox, Claude can run more autonomously and safely execute commands without permission prompts. If Claude tries to access somethingoutsideof the sandbox, you'll be notified immediately, and can choose whether or not to allow it. We’ve built this on top of OS level primitives such asLinux bubblewrapand MacOS seatbelt to enforce these restrictions at the OS level. They cover not just Claude Code's direct interactions, but also any scripts, programs, or subprocesses that are spawned by the command.As described above, this sandbox enforces both:
- Filesystem isolation,by allowing read and write access to the current working directory, but blocking the modification of any files outside of it.
- Network isolation,by only allowing internet access through a unix domain socket connected to a proxy server running outside the sandbox. This proxy server enforces restrictions on the domains that a process can connect to, and handles user confirmation for newly requested domains. And if you’d like further-increased security, we also support customizing this proxy to enforce arbitrary rules on outgoing traffic.
Both components are configurable: you can easily choose to allow or disallow specific file paths or domains. Sandboxing ensures that even a successful prompt injection is fully isolated, and cannot impact overall user security. This way, a compromised Claude Code can't steal your SSH keys, or phone home to an attacker's server. To get started with this feature, run /sandbox in Claude Code and check outmore technical detailsabout our security model. To make it easier for other teams to build safer agents, we haveopen sourcedthis feature. We believe that others should consider adopting this technology for their own agents in order to enhance the security posture of their agents.
Claude Code on the web: running Claude Code securely in the cloud
Today, we're also releasingClaude Code on the webenabling users to run Claude Code in an isolated sandbox in the cloud. Claude Code on the web executes each Claude Code session in an isolated sandbox where it has full access to its server in a safe and secure way. We've designed this sandbox to ensure that sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code. This way, even if the code running in the sandbox is compromised, the user is kept safe from further harm. Claude Code on the web uses a custom proxy service that transparently handles all git interactions. Inside the sandbox, the git client authenticates to this service with a custom-built scoped credential. The proxy verifies this credential and the contents of the git interaction (e.g. ensuring it is only pushing to the configured branch), then attaches the right authentication token before sending the request to GitHub.
Getting started
Our new sandboxed bash tool and Claude Code on the web offer substantial improvements in both security and productivity for developers using Claude for their engineering work. To get started with these tools:
- Run
/sandboxin Claude and check outour docson how to configure this sandbox. - Go toclaude.com/codeto try out Claude Code on the web.
Or, if you're building your own agents, check out ouropen-sourced sandboxing code, and consider integrating it into your work. We look forward to seeing what you build. To learn more about Claude Code on the web, check out ourlaunch blog post.
Acknowledgements
Article written by David Dworken and Oliver Weller-Davies, with contributions from Meaghan Choi, Catherine Wu, Molly Vorwerck, Alex Isken, Kier Bradwell, and Kevin Garcia