Security
Brig and Anthropic's containment guide
On this page
Anthropic's private-beta containment guide describes a reference sandbox: one microVM per agent, no host files, and egress denied outside the guest. Brig gives you the microVM and the egress control on a Mac or a Linux host. This page compares Brig with each property of the reference design, and lists the hand checks to run under Brig.
The Brig project wrote this page. Anthropic has not reviewed or endorsed it. The guide calls its practices recommendations, which reduce risk but may not prevent every out-of-scope action.
What the guide is #
Anthropic publishes the guide for customers in its Cyber Verification Program, which Brig and the CVP practices explains. It has five parts: sandboxing, auto mode, prompt injection, offline monitoring of transcripts, and online monitoring with a sandbox escape classifier in the API.
The sandboxing part describes a reference design. Each agent runs as claude -p in its own microVM, from Kata Containers with Firecracker, on an internal network. A credential proxy outside the sandbox adds the model-API key to each request, and an egress proxy refuses every other destination. The design needs a Linux host with KVM. It does not support macOS or Windows. For those, the guide points you to a VM on the platform's own hypervisor.
Brig is that VM on macOS: hvi runs each sandbox on Hypervisor.framework. On Linux, Brig runs each sandbox under KVM through urunc and Cloud Hypervisor. See Architecture.
Which checks apply #
The guide's checks depend on how the agent runs. Brig runs Claude Code, so these apply:
| Check | Under Brig |
|---|---|
| Auto mode | Yes. See Auto mode |
| Sandbox escape score in API responses | No. Claude Code does not surface the score |
| Transcript review | Yes. Brig keeps the transcripts on the host. See Local work |
The reference properties #
The guide lists eight properties of the reference design, for anyone who builds their own sandbox. The status words are the ones in the status key.
| Property | Status | Under Brig |
|---|---|---|
| Each agent has its own guest kernel | Brig does it | Every sandbox is a microVM. See Isolation boundary |
| No host directory is shared into the guest | Brig differs | Brig shares the guest home, and the project you name, read-write. --no-project drops the project. The guest home is always a share. No other host directory reaches the guest. See What the agent can reach |
| The model-API credential is not in the guest | You set it up | A route on the claude-code preset keeps the login on the host. The guest gets a session token for the route, and no .credentials.json. Without a route, the login is a file inside the guest, on a memory-backed mount that never reaches host disk. See Credential broker and File delivery |
| No internet access, enforced outside the guest, with an allowlist | You set it up | A policy with default: deny does this, outside the guest kernel. The reference design keeps the model-API host off its allowlist, because its agents reach the model only through the credential proxy. Under Brig with a route, the agent reaches the model through the broker, so the API host stays off the list too. See Enforcement |
| The cloud metadata service is unreachable | You set it up | A default: deny policy with no cidr allow for those ranges refuses it. On Linux, Brig's nftables table refuses 169.254.0.0/16 under every policy. With no policy, Brig makes no claim about host services. See Host services |
| Every agent has a turn limit, and a time limit if you set one | Outside Brig | Brig limits memory and vCPUs, not turns or time. brig stop <ref> ends a run |
| No privileged mode, added capabilities, device passthrough or host networking | Brig does it | Brig's run line has no flag for any of them. On Linux, Brig refuses runc and crun, which share the host kernel |
| The orchestrator runs on the host and writes the transcripts there | Brig differs | Brig runs on the host, and Claude Code writes its transcripts from inside the guest, to a share on host disk. The agent can change them. Copy them after each run |
The reference design also confines the VMM on the host, with Firecracker's jailer. On macOS, hvi enters a Seatbelt profile that denies by default before the first vCPU starts. See The boundary in hvi. hvi is in process for an external security audit. No third-party review is published yet.
Hand checks #
The guide lists five checks to run by hand on each host. The table gives the Brig command for each and the result to expect. Run them on your own host before a real engagement, with the cvp-local policy from A run set up this way attached to claude.
| What to confirm | How | Expected under Brig |
|---|---|---|
| A separate guest kernel | brig sh claude -c 'uname -r', and uname -r on the host |
The versions differ. On macOS the host is not Linux at all, so the ISOLATION row of brig info claude is the more useful check |
| The VMM is confined on the host | On macOS, read the boot output, and run hvi sandbox-selftest |
At boot, hvi prints [hvi] seatbelt sandbox: on (deny default). The selftest probes what a confined thread keeps and what it loses |
| A host file is not visible inside | touch /tmp/brig-probe on the host, then brig sh claude -c 'ls /tmp/brig-probe' |
Not found |
| Egress is refused | brig sh claude -c 'curl -sS https://example.com' |
The name does not resolve. Under a route policy with no allow rule for it, a direct request to api.anthropic.com fails the same way |
| No credential in the guest | brig info claude lists the guest's environment by name. brig sh claude -c 'ls -l /brig/claude/.credentials.json' |
Under a route, the file is not there, and the environment names CLAUDE_CODE_OAUTH_TOKEN, which holds a session token. Without a route, the file is there after brig secret import claude or a login inside the sandbox. See the credential row |
A passing check is a minimum bar, not proof of isolation. The guide says the same of its own checks.
Not covered by Brig #
These parts of the guide are about your prompts, your harness and your review process:
- prompt injection from content a target serves
- offline review of transcripts and logs, and what to do on a hit
- the sandbox escape score from the Messages API
Sources #
Read on 2026-10-06.
- Agent containment best practices: getting started, Anthropic, private beta.
- Agent containment best practices: sandboxing, Anthropic, private beta.
- Agent containment best practices: auto mode, Anthropic, private beta.
- The facts about Brig come from Security, Networking, Architecture and Command line on this site.