brig docs

Security

Brig and the CVP practices

On this page

Anthropic recommends containment practices for agents that run on models from its Cyber Verification Program. Brig covers the sandbox and the network practices on your own Mac or Linux host. This page takes each practice in turn and says what Brig does and what you add.

The Brig project wrote this page. Anthropic has not reviewed or endorsed it. Anthropic's practices are recommendations, and they reduce risk without removing it. Brig follows them in part, and the table rows say where it differs.

What the CVP is #

The Cyber Verification Program (CVP) gives approved organizations and individuals access to Anthropic's most capable models with reduced safeguards, for security work such as vulnerability discovery, pentesting and red teaming. Anthropic notes that an agent asked to do offensive-security work can act beyond the scope it was given. Its containment practices limit what such an agent can reach and make what it did reviewable.

The program also has security requirements for accounts and sign-in, such as phishing-resistant multi-factor authentication. This page does not cover them.

Brig and Anthropic's containment guide compares Brig with the reference design in Anthropic's private-beta guidance.

Status key #

Status Meaning
Brig does it Brig does this on every run
You set it up Brig has the control, and you turn it on or point it
Brig differs Brig does something else. The row says what
Outside Brig Your harness, your prompt or your team does this

A run set up this way #

A policy that sends Claude Code to the model API through the credential broker, and allows nothing else:

apiVersion: brig.sh/v1alpha1
kind: Policy
metadata:
  name: cvp-local
  description: Claude Code through the broker, and no other egress
spec:
  egress:
    default: deny
  routes:
    - name: anthropic
      preset: claude-code
      credential:
        secretRef: { name: claude-credentials }

Store the login on the host, attach the policy, check the run, then start the agent in auto mode:

brig secret import claude-code    # stores your Claude Code login as claude-credentials
brig policy create cvp-local      # opens the starter in your editor
brig policy attach cvp-local claude
brig plan claude ~/lab/target     # prints mounts, network, policy and credentials, boots nothing
brig run claude ~/lab/target -- --permission-mode auto

For a pentest, add an allow list under egress with each in-scope target, such as - cidr: 10.0.3.0/24.

Local work #

Anthropic's first set of practices covers jobs that need no internet access, such as vulnerability finding, patching and testing a local install of a web application.

Practice Status Under Brig
Run the agent in a VM Brig does it Every sandbox is a microVM with its own kernel. On macOS, hvi runs it on Hypervisor.framework, which is the macOS option Anthropic names. On Linux, urunc runs it on Cloud Hypervisor under KVM. Anthropic names Firecracker for Linux. The ISOLATION row of brig info names the boundary each run gets. See Isolation boundary
Block egress except the model API You set it up With no policy, a sandbox has open internet access. Attach a policy with default: deny, as in the example above. Brig enforces it outside the guest kernel: at the network gateway on hvi, and in nftables on Linux. On vz, qemu and docker, Brig refuses to boot under a policy, with exit code 7. See Enforcement
Reach the model API through a proxy that adds the key You set it up A route on the claude-code preset does this, as in the example above. Brig's credential broker runs on the host, keeps Claude Code's login there and adds it to each request. The guest holds the route URL and a session token, which brig stop revokes, and no .credentials.json. Routes run on hvi and on nerdctl with urunc. On vz, qemu and docker, Brig refuses the run with exit code 7. Without a route, Brig delivers the login into the guest as a file, on a memory-backed mount that never reaches host disk, and the agent can read it, refresh token included. Brig refuses to forward ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN from your shell. See File delivery
Tell the agent not to use the internet Outside Brig Put it in the prompt, even though the policy blocks it
Install every tool before the run You set it up Build the tools into a guest image, so the run fetches nothing
Review the sandbox configuration You set it up brig plan <ref> <project> prints the mounts, the network, the policies, the limits, the image, the runtime and the credentials by name, and boots nothing. Give Claude that output and the policy file to review. See brig plan
Run a supervised escape test You set it up Run the test agent with the same brig run line as a real engagement. Hand checks lists the checks to run yourself
Keep transcripts for 30 days You set it up Claude Code writes its transcripts to ~/.brig/homes/brig-claude-code/.claude/projects on the host. They survive brig stop, and brig rm deletes them. The agent writes them from inside the sandbox, so it can also change them. Copy them after each run to a place the agent cannot reach. See Host disk
Keep egress logs for 30 days Brig differs On Linux, Brig logs each refused name to ~/.brig/egress/<sandbox>.log. brig stop removes the log, and a refused connection is not logged. Copy the log before you stop the sandbox. On hvi, Brig and hull document no log of refused requests. See On Linux
Use Claude Code's auto mode You set it up Brig leaves the permission mode to the agent. Pass --permission-mode auto after -- on the run line, and do not use bypassPermissions. See Auto mode

Pentesting and red teaming #

Anthropic's second set covers jobs that need network access to targets.

Practice Status Under Brig
Allow egress to the model API and the in-scope targets only You set it up Add each target to the policy's allow list, by host or by cidr. A host rule decides an address, so two names behind one address get the same verdict. See Limits
Test against staging or a replica Outside Brig Point the engagement at a copy of production
State the scope in the agent's instructions Outside Brig Write the targets, the permitted actions and what is out of scope into the prompt. Phrase each limit as intent, such as "do not access hosts outside 10.0.3.0/24"
Broker access to the target Outside Brig Give the agent tools or an access proxy you can observe
Supervise each run, with a way to halt it You set it up brig stop <ref> stops the sandbox and everything in it. Brig sets no turn limit and no time limit on a run. See brig stop
Monitor long runs continuously Outside Brig Anthropic's sandbox escape score comes back in Messages API responses. Claude Code does not surface it, so it does not apply to an agent that Brig runs
Use Claude Code's auto mode You set it up As for local work. See Auto mode
Keep autonomous agents off live high-consequence systems Outside Brig Do not point an agent at live OT, ICS, medical or energy systems

Auto mode #

Auto mode is a permission classifier inside Claude Code. It checks each risky tool call before it runs. Anthropic treats it as a check inside the sandbox. The microVM stays the boundary.

brig run claude ~/lab/target -- --permission-mode auto

Claude Code reads auto mode rules from user and managed settings only, and ignores them in a project's .claude/settings.json. Under Brig, the user settings file is ~/.brig/homes/brig-claude-code/.claude/settings.json on the host, which the agent reads at /brig/claude/settings.json. The agent can write that file too. To fix a setting the agent cannot change, put it in managed settings in your guest image.

In autoMode.environment, state facts about the sandbox:

  • the agent runs in a Brig microVM with its own kernel
  • egress is denied except the hosts in the attached policy, and name them
  • the targets that are in scope

Start each list with "$defaults", so Claude Code keeps its built-in rules.

Sources #

Read on 2026-10-06.

Type a command, a flag or an error message.