Issues

• The ask callback cannot tell which invocation opened the connection

  anthropics/sandbox-runtime#734 · Filter by author ken-jo opened on Oct 16, 2026

• windows: wfp status reads installed with one block filter missing, and a plain install does not repair it

  anthropics/sandbox-runtime#723 · Filter by author blairducrayoppat opened on Oct 15, 2026

• macOS: no way to grant ioctl on only the pty a caller spawns the command on

  anthropics/sandbox-runtime#721 · Filter by author ken-jo opened on Oct 15, 2026
  1

• macOS log monitor drops all but the first violation in each log stream chunk

  anthropics/sandbox-runtime#720 · Filter by author TheKevJames opened on Oct 15, 2026

• Masked credentials are substituted in request bodies, so an injectHost that stores what it is sent hands the real value back

  anthropics/sandbox-runtime#714 · Filter by author carlostapiacl opened on Oct 15, 2026

• macOS log monitor drops violations when log stream delivers several entries in one chunk

  anthropics/sandbox-runtime#696 · Filter by author kkrafft1999 opened on Oct 12, 2026

• Windows: filesystem denials never reach the violation store

  anthropics/sandbox-runtime#658 · Filter by author karljamoralin opened on Oct 6, 2026

• Windows: sandbox user can't stat ancestors of allowed folders, and placeholder deny targets are left in the caller's cwd

  anthropics/sandbox-runtime#657 · Filter by author karljamoralin opened on Oct 6, 2026
  1

• Linux: /tmp/claude is writable and shared by all concurrent sandboxes of a user, so per-sandbox filesystem grants cannot isolate them

  anthropics/sandbox-runtime#654 · Filter by author mkorun opened on Oct 5, 2026

• Windows: initialize() runs srt-win acl grant/stamp/restore via spawnSync, blocking the host event loop for up to 60s

  anthropics/sandbox-runtime#647 · Filter by author karljamoralin opened on Oct 3, 2026

• External institutional authority binding for sandbox policy activation

  anthropics/sandbox-runtime#646 · Filter by author veraxis-protocol opened on Oct 2, 2026

• Linux: sandboxed TUI never receives SIGWINCH (bwrap --new-session), so it keeps its launch size

  anthropics/sandbox-runtime#642 · Filter by author IanSPoxon opened on Oct 2, 2026

• checkDependencies() ignores seccomp.applyPath when called before initialize()

  anthropics/sandbox-runtime#631 · Filter by author karljamoralin opened on Sep 29, 2026

• Windows: srt-win exec does not forward stdin to the sandboxed child (stdout works)

  anthropics/sandbox-runtime#623 · Filter by author webprodigies opened on Sep 28, 2026
  1

• Linux: automatic temporary-directory grants retain reads despite explicit denyRead

  anthropics/sandbox-runtime#611 · Filter by author henrymodisett opened on Sep 27, 2026

• HTTP proxy CONNECT tunnel truncates responses when the upstream closes the connection

  anthropics/sandbox-runtime#606 · Filter by author aciDrums7 opened on Sep 25, 2026
  3

• gVisor: another Linux sandbox option

  anthropics/sandbox-runtime#605 · Filter by author rexren-gif opened on Sep 25, 2026

• A single Ctrl-C reaches the sandboxed command twice; on Linux it kills the command even when it handles SIGINT

  anthropics/sandbox-runtime#603 · Filter by author carlostapiacl opened on Sep 24, 2026
  2

• srt exits 0 when the sandboxed command is killed by a signal

  anthropics/sandbox-runtime#602 · Filter by author carlostapiacl opened on Sep 24, 2026
  1

• macOS: getaddrinfo address sorting is denied as bare network-outbound (com.apple.netsrc kernel control)

  anthropics/sandbox-runtime#599 · Filter by author FerDev12 opened on Sep 23, 2026

• macOS: literal allowWrite paths are not canonicalized — a /tmp rule never matches /private/tmp

  anthropics/sandbox-runtime#596 · Filter by author hellsbellscw opened on Sep 22, 2026
  1

• cli: filesystem violations are never collected, and collected ones never reach a caller that runs the binary

  anthropics/sandbox-runtime#582 · Filter by author carlostapiacl opened on Sep 20, 2026

• macOS: a caller-supplied literal path containing […] compiles to a non-matching regex, silently voiding denyRead (and a glob-sniffed allowWrite loses its subtree)

  anthropics/sandbox-runtime#576 · Filter by author heavysixer opened on Sep 19, 2026
  1

• iokit-open on macOS is hardcoded to 3 classes with no config surface — blocks Metal (and likely other IOKit-backed device access)

  anthropics/sandbox-runtime#560 · Filter by author arleckk opened on Sep 17, 2026
  1

• Windows: local named pipes are both discoverable and reachable from the sandboxed process — no equivalent of allowUnixSockets/blocked-by-default for local IPC

  anthropics/sandbox-runtime#559 · Filter by author arleckk opened on Sep 17, 2026