How we contain Claude across products

Anthropic describes practical security incidents and architectural lessons from deploying agentic AI (Claude) across claude.ai, Claude Code, and Claude Cowork. The post details three classes of risk (user misuse, model misbehavior, external attackers) and chronicles concrete failures: project-local config executing before trust prompts, a phishing-based prompt-injection that exfiltrated credentials, and an allowlist-based egress bypass that uploaded user files to an attacker-controlled Anthropic account. The authors explain containment patterns (ephemeral containers, human-in-the-loop sandboxes, local VMs), fixes (defer config parsing, egress MITM proxy, tightened filesystem and mount controls), and guidance for matching isolation strength to user capability and avoiding custom brittle components.