AI Insights · Oct 22, 2026 · Verified

How Claude Code keeps agents contained

Claude Code uses subagents to separate context and permissions, and operating-system sandboxes to enforce limits. An automatic classifier has replaced most permission prompts.

Claim

Claude Code's harness treats subagents as the unit of context and permission isolation, enforces boundaries with OS sandboxes rather than prompts, and replaced per-action permission prompts with a two-stage classifier. Its "dynamic workflows" let the model write a per-task multi-agent harness.

Evidence

  • Subagents: own context window; frontmatter-configured tools, model, permission mode, hooks, memory and skills; isolation: worktree; background execution; 3 levels of nesting; 20 concurrent by default. Only the final summary returns and is labelled as subagent output, not user instructions. Agent Teams (experimental): lead plus independent teammates, file-locked shared task list, mailboxes; inter-agent messages cannot grant consent. Agent teams use about 7x the tokens of a standard session.
  • Sandboxing (2025-10-20): bubblewrap on Linux, Seatbelt on macOS; filesystem and network isolation; credentials kept outside the sandbox behind a scoped git proxy on the web product.
  • Auto mode (2026-03-25): allowlist, then in-project edits, then a transcript classifier with a fast filter and a reasoning stage. The classifier sees only user messages and tool calls ("we strip assistant text so the agent can't talk the classifier into making a bad call"); a separate prompt-injection probe on tool results; 3 consecutive or 20 total denials escalate to a human. On 10,000 real actions: false-positive rate 0.4% end to end; false-negative 17% on real overeager actions, 5.7% on synthetic exfiltration. Users had accepted 93% of manual prompts, which motivated it.
  • Long-running patterns (2025-11-26): initializer agent, JSON feature list that agents may only flip to passing (JSON because models overwrite it less than Markdown), progress file, git commits, init.sh; end-to-end browser testing required because Claude marked features done after unit tests.
  • Dynamic workflows (2026-06-02): agent(), parallel(), pipeline() primitives with schema, model and isolation options; patterns include fan-out and synthesise, adversarial verification, tournament; "quarantine" agents that read untrusted content get no privileges; pairwise comparison preferred over absolute scoring; a 22-agent deep-research run used 1.1M tokens in 11 minutes.

Open questions

  • Whether auto mode's classifier is exposed to Agent SDK users for custom tools.

Sources

AI-assisted research: gathered and summarised with AI from the sources above, each claim checked against them.

Related

Book a demo