Underwhelming: How Anthropic contains Claude

Anthropic published in May 2026 how they contain Claude across Claude.ai, Claude Code, and Cowork: gVisor sandboxes, full VMs, egress controls, the works. We go through it end to end: what holds up, what’s broken, and what they’re still missing.

This is a reaction to “How We Contain Claude Across Products,” published by Anthropic on May 28, 2026: https://www.anthropic.com/engineering/how-we-contain-claude

Topics covered:

The three types of agent security risk: user misuse, model misbehavior, external attackers
Why human-in-the-loop approval fails (93% approval rate, approval fatigue)
Anthropic’s three containment patterns: ephemeral container (Claude.ai), human-in-the-loop sandbox (Claude Code local), sealed VM (Cowork)
DNS exfiltration through an “approved” domain, and why VM isolation blinds your EDR tooling
What’s coming next: memory poisoning, multi-agent trust escalation, agent identity

Bottom line: containment beats supervision, but coding agents still don’t have a real sandbox story — and that gap is exactly where the risk lives.