Claude Code's OS-level sandboxing exists but ships off by default — turn it on

Northflank·medium signal

Claude Code uses Bubblewrap and Landlock on Linux and Seatbelt on macOS to apply filesystem and network restrictions the agent cannot escape, with no daemon, container, VM, or disk overhead — but the sandbox is off by default. Given GuardFall and the GitHub Action key-leak disclosures, this is the highest-leverage single toggle available right now, because it enforces at the kernel level rather than asking the model to behave. Pair it with the defense-in-depth stack the 2026 consensus has converged on: compute isolation (microVM/gVisor/hardened container) + filesystem restrictions + egress allowlist + resource caps, with an ephemeral lifecycle that destroys the environment after each task.