How we contain Claude across products (28 minute read)

Details

Anthropic published detailed engineering post on agentic safety architecture across three product lines. Core thesis: blast radius grows faster than control mechanisms. Two approaches to capping it: (1) human-in-loop supervision (fallible—users approve 93% of permission prompts, attention degrades), (2) containment via sandboxes, VMs, egress controls. Claude Code added auto mode to reduce approval fatigue, but vulnerabilities persist. The article catalogs surprising failures and what held up: memory isolation, filesystem restrictions, network egress filtering, process isolation. Claude Mythos was deemed too dangerous to ship in April 2026 despite capabilities, with broader release expected only as defenders harden systems and safeguards mature. Risk components: likelihood (mitigated by safeguards and model training) and damage (theoretical blast radius expanding with access). As agents become capable of work requiring people or teams, cost of non-deployment weighs against residual risk.