Agent Containment and Blast Radius

As agents grow more capable, the risk of a deployment has two components: how likely a failure is, and how much damage one could do. Model training and safeguards drive down the first; the second — the theoretical blast radius — only grows as capabilities and access expand. The engineering question becomes how to cap it. [source: anthropic-engineering-how-we-contain-claude-2026]

Why human-in-the-loop supervision fails

Per-action permission prompts theoretically keep users safe, but Anthropic’s telemetry showed users approve roughly 93% of permission prompts. The more approvals a user sees, the less attention they pay to each — approval fatigue turns an oversight feature into rubber-stamping. Anonymized usage data showed experienced users auto-approve roughly twice as often as new users, supervising the agent only when it visibly drifts. [source: anthropic-engineering-how-we-contain-claude-2026]

Three risk types, three defense components

Risks fall into three categories: user misuse, model misbehavior (overeager initiative, honest mistakes about blast radius), and external attackers (prompt injection and conventional attacks on the runtime). Defenses apply to three components: [source: anthropic-engineering-how-we-contain-claude-2026]

1. The environment — process sandboxes, VMs, filesystem boundaries, egress controls. Hard boundaries: if credentials never enter the sandbox, they can’t be exfiltrated regardless of cause. A tight perimeter lets you relax oversight.
2. The model — system prompts, classifiers, probes, training. Probabilistic: shapes what the agent tends to do, never what it can do.
3. The external content — MCP servers, plugins, web tools feed unaudited data into context; an audited connector is not audited data.

Classifier-gated autonomy (auto mode)

Claude Code auto mode replaces per-action human approval with layered model-based classifiers: a server-side prompt-injection probe screens tool outputs entering context, and a two-stage transcript classifier (fast single-token filter, then chain-of-thought reasoning only on flagged actions) gates tool calls before execution. The classifier is deliberately reasoning-blind: it sees only user messages and tool calls, with assistant text and tool outputs stripped so the agent cannot talk it into a bad call and injected content never reaches it. [source: anthropic-engineering-claude-code-auto-mode-2026]

Measured trade-off: the full pipeline cut false positives on real traffic from 8.5% to 0.4%, at the cost of a 17% false-negative rate on real overeager actions. Anthropic frames this honestly: an improvement over skipping permissions entirely, arguably a regression versus careful manual review. [source: anthropic-engineering-claude-code-auto-mode-2026]

Containment patterns by audience

• Ephemeral container (claude.ai): server-side gVisor container, per-session filesystem — minimal blast radius, low capability ceiling.
• Human-in-the-loop sandbox (Claude Code): works only because users are developers who can read bash; an OS-level sandbox (Seatbelt/bubblewrap, network denied by default) cut permission prompts by 84%.
• Local VM (Cowork): for non-technical users the boundary must be absolute and always-on — workspace-only mounts, credentials never enter the guest. [source: anthropic-engineering-how-we-contain-claude-2026]

Lessons from failures

• Everything before the trust dialog is attack surface: project-local config was parsed before the “Do you trust this folder?” prompt, letting a committed hook execute on open. Treat project-open and config-load like inbound internet requests.
• The user is an injection vector: a phished “run this for me” prompt exfiltrated credentials in 24 of 25 attempts — model-layer defenses anchor on user intent, so only environment controls (egress, filesystem boundaries) hold.
• An allowlist is a capability grant, not a destination filter: allowing api.anthropic.com allowed file uploads to an attacker’s account through it.
• The weakest layer is the one you built yourself: hardened primitives (gVisor, seccomp, hypervisors) held; the custom proxy broke. [source: anthropic-engineering-how-we-contain-claude-2026]

Related Concepts

• agent harness engineering
• multi agent orchestration
• subagents and context management
• agentic engineering patterns
• anthropic