---
title: "Agent Containment and Blast Radius"
description: "Capping what an agent can do — not just what it tends to do — via sandboxes, VMs, egress controls, and classifier-gated approvals layered over fallible human oversight."
section: "concepts"
type: "concept"
created: "2026-08-24"
updated: "2026-08-29"
confidence: "high"
tags: ["agents", "security", "workflow", "evaluation"]
canonical: "https://pyweb.dev/wiki/agent-containment-and-blast-radius"
---
# Agent Containment and Blast Radius

As agents grow more capable, the risk of a deployment has two components: how likely a failure is, and how much damage one could do. Model training and safeguards drive down the first; the second — the theoretical **blast radius** — only grows as capabilities and access expand. The engineering question becomes how to cap it. [[source: anthropic-engineering-how-we-contain-claude-2026]](/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026)

## Why human-in-the-loop supervision fails

Per-action permission prompts theoretically keep users safe, but Anthropic's telemetry showed users approve roughly 93% of permission prompts. The more approvals a user sees, the less attention they pay to each — **approval fatigue** turns an oversight feature into rubber-stamping. Anonymized usage data showed experienced users auto-approve roughly twice as often as new users, supervising the agent only when it visibly drifts. [[source: anthropic-engineering-how-we-contain-claude-2026]](/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026)

## Three risk types, three defense components

Risks fall into three categories: **user misuse**, **model misbehavior** (overeager initiative, honest mistakes about blast radius), and **external attackers** (prompt injection and conventional attacks on the runtime). Defenses apply to three components: [[source: anthropic-engineering-how-we-contain-claude-2026]](/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026)

1. **The environment** — process sandboxes, VMs, filesystem boundaries, egress controls. Hard boundaries: if credentials never enter the sandbox, they can't be exfiltrated regardless of cause. A tight perimeter lets you relax oversight.
2. **The model** — system prompts, classifiers, probes, training. Probabilistic: shapes what the agent *tends* to do, never what it *can* do.
3. **The external content** — MCP servers, plugins, web tools feed unaudited data into context; an audited connector is not audited data.

## Classifier-gated autonomy (auto mode)

Claude Code auto mode replaces per-action human approval with layered model-based classifiers: a server-side **prompt-injection probe** screens tool outputs entering context, and a two-stage **transcript classifier** (fast single-token filter, then chain-of-thought reasoning only on flagged actions) gates tool calls before execution. The classifier is deliberately **reasoning-blind**: it sees only user messages and tool calls, with assistant text and tool outputs stripped so the agent cannot talk it into a bad call and injected content never reaches it. [[source: anthropic-engineering-claude-code-auto-mode-2026]](/wiki/raw/articles/anthropic-engineering-claude-code-auto-mode-2026)

Measured trade-off: the full pipeline cut false positives on real traffic from 8.5% to 0.4%, at the cost of a 17% false-negative rate on real overeager actions. Anthropic frames this honestly: an improvement over skipping permissions entirely, arguably a regression versus careful manual review. [[source: anthropic-engineering-claude-code-auto-mode-2026]](/wiki/raw/articles/anthropic-engineering-claude-code-auto-mode-2026)

## Containment patterns by audience

- **Ephemeral container** (claude.ai): server-side gVisor container, per-session filesystem — minimal blast radius, low capability ceiling.
- **Human-in-the-loop sandbox** (Claude Code): works only because users are developers who can read bash; an OS-level sandbox (Seatbelt/bubblewrap, network denied by default) cut permission prompts by 84%.
- **Local VM** (Cowork): for non-technical users the boundary must be absolute and always-on — workspace-only mounts, credentials never enter the guest. [[source: anthropic-engineering-how-we-contain-claude-2026]](/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026)

## Lessons from failures

- **Everything before the trust dialog is attack surface:** project-local config was parsed before the "Do you trust this folder?" prompt, letting a committed hook execute on open. Treat project-open and config-load like inbound internet requests.
- **The user is an injection vector:** a phished "run this for me" prompt exfiltrated credentials in 24 of 25 attempts — model-layer defenses anchor on user intent, so only environment controls (egress, filesystem boundaries) hold.
- **An allowlist is a capability grant, not a destination filter:** allowing `api.anthropic.com` allowed file uploads to an attacker's account through it.
- **The weakest layer is the one you built yourself:** hardened primitives (gVisor, seccomp, hypervisors) held; the custom proxy broke. [[source: anthropic-engineering-how-we-contain-claude-2026]](/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026)

## Related Concepts
- [agent harness engineering](/wiki/agent-harness-engineering)
- [multi agent orchestration](/wiki/multi-agent-orchestration)
- [subagents and context management](/wiki/subagents-and-context-management)
- [agentic engineering patterns](/wiki/agentic-engineering-patterns)
- [anthropic](/wiki/anthropic)

---

## Agent Navigation

cluster: person (170 pages) | betweenness: 704.1

### References (outbound)
- [Agent Harness Engineering](https://pyweb.dev/wiki/agent-harness-engineering.md)
- [Multi-Agent Orchestration](https://pyweb.dev/wiki/multi-agent-orchestration.md)
- [Subagents and Context Management](https://pyweb.dev/wiki/subagents-and-context-management.md)
- [Agentic Engineering Patterns](https://pyweb.dev/wiki/agentic-engineering-patterns.md)
- [Anthropic](https://pyweb.dev/wiki/anthropic.md)

### Referenced by (inbound)
- [Agent Harness Engineering](https://pyweb.dev/wiki/agent-harness-engineering.md)
- [Agentic Code Quality](https://pyweb.dev/wiki/agentic-code-quality.md)
- [Agentic Vulnerability Lifecycle](https://pyweb.dev/wiki/agentic-vulnerability-lifecycle.md)
- [Codex Harness Architecture](https://pyweb.dev/wiki/codex-harness-architecture.md)
- [Constraint Layering](https://pyweb.dev/wiki/constraint-layering.md)
- [Five Debts of Agentic Engineering](https://pyweb.dev/wiki/five-debts-of-agentic-engineering.md)
- [Software Engineering Fundamentals for Agents](https://pyweb.dev/wiki/software-engineering-fundamentals-for-agents.md)
- [Anil Madhavapeddy](https://pyweb.dev/wiki/anil-madhavapeddy.md)
- [Anthropic](https://pyweb.dev/wiki/anthropic.md)
- [Nick Craig-Wood](https://pyweb.dev/wiki/nick-craig-wood.md)
- [Agentic Code Quality — Evidence Map](https://pyweb.dev/wiki/agentic-quality-evidence.md)

### Evidence (verified primary sources)
- [anthropic-engineering-how-we-contain-claude-2026](https://pyweb.dev/wiki/raw/articles/anthropic-engineering-how-we-contain-claude-2026.md) | origin: https://www.anthropic.com/engineering/how-we-contain-claude | ingested: 2026-08-24 | sha256: a3572717f07b311f60b8249240dde9723232b8443ad08fb72cc67189cc802380
- [anthropic-engineering-claude-code-auto-mode-2026](https://pyweb.dev/wiki/raw/articles/anthropic-engineering-claude-code-auto-mode-2026.md) | origin: https://www.anthropic.com/engineering/claude-code-auto-mode | ingested: 2026-08-24 | sha256: 46652f8d2c252d34b6b2a7e61576043116d1332acee442bd596cbc71fc78bb83
- [simon-willison-breaking-claude-code-opus-5-auto-mode-2026](https://pyweb.dev/wiki/raw/articles/simon-willison-breaking-claude-code-opus-5-auto-mode-2026.md) | origin: https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/ | ingested: 2026-08-29 | sha256: a380ad49682e3badf6d3ad549f89806c9d26ed4f21ec1961f37c89c0a934013f

### Machine endpoints
- Knowledge graph: https://pyweb.dev/api/graph.json
- Graph analysis: https://pyweb.dev/api/graph-analysis.json
- Context index: https://pyweb.dev/llms.txt