An open-source tool to isolate AI agents at the system level

Anthropic has released sandbox-runtime (srt), an open-source tool under the Apache 2.0 license, designed to restrict file and network access for processes executed by AI agents. Unlike container-based solutions like Docker, srt operates directly at the operating system level, without requiring virtualization. According to the MarkTechPost, this tool was developed to address specific risks: without network isolation, an AI agent could exfiltrate SSH keys, and without file isolation, it could escape the sandbox to access the network.

Without network isolation, a prompt-injected agent could exfiltrate SSH keys, and without file isolation, it could escape the sandbox to access the network.

Technical features and operating system compatibility

The sandbox-runtime uses different mechanisms depending on the operating system. On macOS, it relies on sandbox-exec with dynamic profiles generated by Seatbelt, requiring only ripgrep as a dependency. On Linux, it uses bubblewrap to remove the network from the namespace, with socat and ripgrep for support. The Windows version, still in alpha phase, uses a dedicated srt-sandbox account, the Windows Filtering Platform (WFP) firewall, and explicit file ACLs. However, some limitations remain, such as incompatibility with tools using the Windows TLS stack (PowerShell, .NET HttpClient, etc.) or HTTPS requests via PowerShell and winget, according to details provided by whatisagenticai.net.

Reduction of permission prompts and advanced configuration

Anthropic states that using srt has reduced permission prompts by 84% in the internal environment of Claude Code, its AI model. The tool allows configuring lists of allowed or blocked domains, wildcards for domain names, and specific ports. Read access is allowed by default, while write access is blocked unless explicitly permitted. Security rules are defined in a ~/.srt-settings.json file, and the tool supports features such as allow-only network policies, Unix socket authorization, and experimental TLS termination, as detailed in the GitHub repository cited by AI Weekly.

What this changes here: implications for businesses and administrations in West Africa

For businesses and administrations in West Africa, where securing digital infrastructures is an increasingly pressing issue, sandbox-runtime could offer a lightweight and effective solution to limit risks associated with the execution of AI agents. Its lack of dependency on containers could simplify deployment in heterogeneous environments, often found in SMEs and public institutions. However, technical limitations, particularly on Windows, may require local adaptations. Organizations using tools like Claude Code or developing their own AI agents could benefit from srt to strengthen the security of sensitive data, provided they test its compatibility with their existing infrastructures.