Issues

• macOS: no way to extend the sysctl-read allowlist, default deny blocks some legitimate tools (.NET / Git Credential Manager)

  anthropics/sandbox-runtime#761 · Filter by author NikhilKalloli opened on Oct 21, 2026

• node-forge GHSA-86w9-cpqp-85rv (no patched version): consider replacing node-forge for MITM cert generation

  anthropics/sandbox-runtime#760 · Filter by author code-yeongyu opened on Oct 21, 2026

• HTTP proxy CONNECT tunnel truncates the response when the origin closes first

  anthropics/sandbox-runtime#756 · Filter by author johgu739 opened on Oct 20, 2026

• macOS: sandboxed commands can read login-keychain items; no setting denies the keychain services

  anthropics/sandbox-runtime#755 · Filter by author canopeego opened on Oct 20, 2026

• Masked credentials are not substituted in the URL query, so an API that takes its key only there can't be used

  anthropics/sandbox-runtime#752 · Filter by author mmmhoj opened on Oct 20, 2026

• Feature request: run the sandbox on a prepared root filesystem (Linux)

  anthropics/sandbox-runtime#750 · Filter by author albertvucinovic opened on Oct 20, 2026

• tlsTerminate: upstream leg ignores the parent proxy (HTTPS_PROXY), so TLS-terminated requests fail behind a proxy

  anthropics/sandbox-runtime#744 · Filter by author niksauer opened on Oct 19, 2026

• Linux: option for a read-only /proc/sys inside the sandbox (in bwrap's /proc and in apply-seccomp's own /proc)

  anthropics/sandbox-runtime#743 · Filter by author jayden1711 opened on Oct 18, 2026

• Linux: sandboxed commands can enumerate host accounts via /etc/passwd; denyRead breaks current-user lookup

  anthropics/sandbox-runtime#742 · Filter by author donnielrt opened on Oct 18, 2026

• Linux: Claude-specific mandatory denies create placeholder entries under cwd (11 /dev/null dotfiles, empty .claude/) that break git add -A for non-Claude consumers

  anthropics/sandbox-runtime#740 · Filter by author donnielrt opened on Oct 17, 2026

• The ask callback cannot tell which invocation opened the connection

  anthropics/sandbox-runtime#734 · Filter by author ken-jo opened on Oct 16, 2026

• windows: wfp status reads installed with one block filter missing, and a plain install does not repair it

  anthropics/sandbox-runtime#723 · Filter by author blairducrayoppat opened on Oct 15, 2026

• macOS: no way to grant ioctl on only the pty a caller spawns the command on

  anthropics/sandbox-runtime#721 · Filter by author ken-jo opened on Oct 15, 2026
  1

• macOS log monitor drops all but the first violation in each log stream chunk

  anthropics/sandbox-runtime#720 · Filter by author TheKevJames opened on Oct 15, 2026

• Masked credentials are substituted in request bodies, so an injectHost that stores what it is sent hands the real value back

  anthropics/sandbox-runtime#714 · Filter by author carlostapiacl opened on Oct 15, 2026

• macOS log monitor drops violations when log stream delivers several entries in one chunk

  anthropics/sandbox-runtime#696 · Filter by author kkrafft1999 opened on Oct 12, 2026

• Windows: filesystem denials never reach the violation store

  anthropics/sandbox-runtime#658 · Filter by author karljamoralin opened on Oct 6, 2026

• Windows: sandbox user can't stat ancestors of allowed folders, and placeholder deny targets are left in the caller's cwd

  anthropics/sandbox-runtime#657 · Filter by author karljamoralin opened on Oct 6, 2026
  1

• Linux: /tmp/claude is writable and shared by all concurrent sandboxes of a user, so per-sandbox filesystem grants cannot isolate them

  anthropics/sandbox-runtime#654 · Filter by author mkorun opened on Oct 5, 2026

• Windows: initialize() runs srt-win acl grant/stamp/restore via spawnSync, blocking the host event loop for up to 60s

  anthropics/sandbox-runtime#647 · Filter by author karljamoralin opened on Oct 3, 2026

• External institutional authority binding for sandbox policy activation

  anthropics/sandbox-runtime#646 · Filter by author veraxis-protocol opened on Oct 2, 2026

• Linux: sandboxed TUI never receives SIGWINCH (bwrap --new-session), so it keeps its launch size

  anthropics/sandbox-runtime#642 · Filter by author IanSPoxon opened on Oct 2, 2026

• checkDependencies() ignores seccomp.applyPath when called before initialize()

  anthropics/sandbox-runtime#631 · Filter by author karljamoralin opened on Sep 29, 2026

• Windows: srt-win exec does not forward stdin to the sandboxed child (stdout works)

  anthropics/sandbox-runtime#623 · Filter by author webprodigies opened on Sep 28, 2026
  1

• Linux: automatic temporary-directory grants retain reads despite explicit denyRead

  anthropics/sandbox-runtime#611 · Filter by author henrymodisett opened on Sep 27, 2026