Anthropic describes how it isolates Claude AI agents across claude.ai, Claude Code, and Claude Cowork using a defense-in-depth approach at the environment layer. Rather than relying solely on model-level safeguards, the company prioritises deterministic boundaries — gVisor containers, OS-level sandboxes, and virtual machines — to cap blast radius when probabilistic controls miss. The three deployment patterns (ephemeral containers, human-supervised sandboxes, sealed VMs) reflect the principle that isolation strength should match the user’s capacity for oversight.
