Anthropic:如何在产品中遏制 Claude 的爆炸半径Anthropic: How We Contain Claude Across Products
Anthropic Engineering 详述了他们在 claude.ai、Claude Code 和 Claude Cowork 三大产品中控制 agent 爆炸半径的实践。核心思路是环境层优先(沙箱、VM、egress 控制),模型层和行为监督作为补充。人类在环批准很快出现疲劳(用户约 93% 直接通过),因此他们转向确定性边界。Claude Code 用 OS 级沙箱(Seatbelt/bubblewrap)把权限提示减少了 84%。Claude Cowork 用完整本地 VM 隔离工作区。文中复盘了多次真实事故:信任对话框前的钩子执行、用户作为注入向量的钓鱼、以及通过已批准域名的数据外泄。原则是:先设计环境遏制,再匹配用户监督能力,并警惕自定义组件。
Anthropic Engineering details containment strategies for Claude agents across claude.ai, Claude Code, and Claude Cowork. The focus is environment-first defenses (sandboxes, VMs, egress controls) over probabilistic model-layer or human-in-the-loop checks. Approval fatigue was real—users approved ~93% of prompts—so they shipped OS-level sandboxes that cut prompts by 84% in Claude Code, and full local VMs for Claude Cowork. Key incidents included pre-trust-dialog hooks, user-as-injection phishing, and exfiltration via allowlisted domains. Core lessons: contain at the environment layer first, match isolation strength to user oversight capacity, and be wary of custom components.
Anthropic Engineering details containment strategies for Claude agents across claude.ai, Claude Code, and Claude Cowork. The focus is environment-first defenses (sandboxes, VMs, egress controls) over probabilistic model-layer or human-in-the-loop checks. Approval fatigue was real—users approved ~93% of prompts—so they shipped OS-level sandboxes that cut prompts by 84% in Claude Code, and full local VMs for Claude Cowork. Key incidents included pre-trust-dialog hooks, user-as-injection phishing, and exfiltration via allowlisted domains. Core lessons: contain at the environment layer first, match isolation strength to user oversight capacity, and be wary of custom components.
Anthropic Engineering details containment strategies for Claude agents across claude.ai, Claude Code, and Claude Cowork. The focus is environment-first defenses (sandboxes, VMs, egress controls) over probabilistic model-layer or human-in-the-loop checks. Approval fatigue was real—users approved ~93% of prompts—so they shipped OS-level sandboxes that cut prompts by 84% in Claude Code, and full local VMs for Claude Cowork. Key incidents included pre-trust-dialog hooks, user-as-injection phishing, and exfiltration via allowlisted domains. Core lessons: contain at the environment layer first, match isolation strength to user oversight capacity, and be wary of custom components.
查看原文 →