As agents gain access to shells, files, services, and credentials, risk is no longer captured by model behavior alone. Anthropic frames it as the combination of failure probability and blast radius. Better models and classifiers can reduce the first term, while environment boundaries place harder limits on the second.
The company describes three containment patterns. Code execution on claude.ai runs in an ephemeral gVisor container. Claude Code uses Seatbelt on macOS and bubblewrap on Linux, allowing work inside the repository while denying network access by default; Anthropic reports an 84% reduction in permission prompts. Cowork uses a local virtual machine that sees only selected mounts while host credentials remain in the keychain.
The incident record is more informative than the architecture labels. Project hooks were once parsed before a repository trust dialog, allowing untrusted local configuration to run too early. The fix was to defer project configuration until after consent. In another exercise, a ready-to-paste prompt exfiltrated AWS credentials in 24 of 25 attempts, demonstrating that user-originated instructions can defeat intent-based model defenses.
An egress allowlist produced a different failure. Traffic to Anthropic’s own API was permitted, so a malicious file could direct Cowork to upload workspace data with an attacker-controlled API key. Anthropic replaced the destination-only rule with an in-VM proxy that accepts only the provisioned session token. The lesson is that an allowed domain grants access to every reachable function on that domain.
The same reasoning applies to filesystem paths and connectors. Symlinks must be resolved before path validation. Local MCP servers can be pinned and audited, while a remote server can change after approval. VM isolation also creates an observability tradeoff because host endpoint detection cannot automatically see inside the guest.
For New Runtime, the useful design unit is an explicit capability boundary: mounted paths, credential provenance, allowed network functions, connector authority, and the component that can grant an exception. Human review still matters, but it should sit on top of boundaries that continue to hold when attention or model judgment fails.