Anthropic details how it isolates Claude in claude.ai, Claude Code, and Claude Cowork

Anthropic's engineering team describes the isolation architecture of its three agent products, claude.ai, Claude Code, and Claude Cowork. The core idea is to set hard boundaries at the environment layer, then guide behavior at the model layer. claude.ai's code execution runs in gVisor containers, with the file system created per session; Claude Code uses human-in-the-loop plus OS-level sandboxing (macOS Seatbelt, Linux bubblewrap), reducing permission prompts by 84%; Claude Cowork uses full virtual machine isolation, with credentials kept in the host keychain, and the workspace supports three mount modes: read-only, read-write, and read-write-no-delete. Anthropic says Claude Opus 4.7 has a single-shot prompt injection attack success rate of about 0.1% on the Gray Swan Agent Red Teaming benchmark, and about 5-6% after 100 adaptive attempts.