Image: GitHub
Why it mattersAn AI agent that writes files on your machine needs a boundary. This gives it one that does not need Docker.
A team hands an AI coding agent write access to their machine. Then they wait. Anthropic's open-source project srt is the piece meant to stop the agent writing where it should not. The project is also called sandbox-runtime. The repository reached rank 12 on Trendshift's daily list on 23 October. The project page shows 5,960 stars, 523 forks and an Apache 2.0 licence. The repository was created on 20 October 2025 under the official Anthropic organisation. It is the isolation layer under Claude Code's own sandboxed shell tool. The project description calls itself "secure by default".
What it does
The README calls srt a lightweight sandboxing tool. It enforces filesystem and network rules on any process, at the operating system level, with no container. On macOS it uses sandbox-exec and Seatbelt profiles. On Linux it uses bubblewrap. On Windows it uses a dedicated local account and Windows Filtering Platform rules.
Filesystem reads work on a deny-then-allow pattern. Writes work on an allow-only pattern. All network access is denied by default. Each allowed call is routed through a local proxy with a domain allow list. The README lists three main uses: sandboxing MCP servers, isolating AI agents, and running untrusted bash commands.
The 0.0.81 release
Version 0.0.81 is the most recent release. Every change in it is on Windows. Sandboxed commands now run under a write-restricted token. A command can no longer write to files where Users or Authenticated Users hold write access. That allow list used to be ignored in those folders. The release also fixes two paths out of the sandbox. One let a sandboxed process start an AppContainer child that reached the network. The other let the sandboxed process impersonate the real user through the standard input pipe.
The release notes mark the whole project a beta research preview. They say Windows is at alpha stability. macOS and Linux are stable.
What it changes
A team running Claude Code, or any agent that uses srt, is choosing a sandbox that does not need Docker. On macOS and Linux the system primitives are already there. On Windows the install creates one local account and sets up the network rules. The project also has a library build. A team writing its own agent can call SandboxManager and wrap a command the way Claude Code does. Anthropic says the configuration format may still change.
Source
anthropics/sandbox-runtime on GitHub, including the v0.0.81 release notes.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
