Agent containment must cover startup code and network destinations

Anthropic’s containment retrospective describes failures that permission dialogs alone did not prevent. Some project configuration ran before a folder was trusted; another attack sent workspace files to an attacker’s account through an allowed API domain. The lesson is to inspect when trust begins and what approved connections permit, alongside filesystem and process isolation.

Anthropic Engineering · May 25, 2026

Why it matters

Relevant to anyone building agent runtimes that read repositories, invoke tools or handle private workspace data.

More context

This May case study is catch-up reading. It compares containers, local sandboxes and virtual machines, including the operational costs of each. For your own harness, review configuration loading before consent and whether network rules distinguish authorized uses of a shared service.

Keep in mind

These are vendor-reported incidents and mitigations, not a claim that current products retain the same flaws. 1min has not reproduced the incidents or audited the implementations.

Original read