Source: Anthropic srt + Claude Code native sandboxing — Aug-2026 landscape pass (research/sandbox-landscape-synthesis-2026-08.md §1/§4; research/INTEGRATION-OPPORTUNITIES-2026-08.md §1). Strategically timely.
What
Claude Code now ships its own OS sandbox (/sandbox, sandbox.* in settings.json) with its own HTTP/SOCKS egress proxy and an enableWeakerNestedSandbox mode for running inside Docker. Sandy already seeds settings.json every launch and points the agent's DNS at its own Go egress proxy. Two uncoordinated proxies can collide / double-prompt, and CC's /sandbox prompts + dangerouslyDisableSandbox fallback can muddy sandy's posture.
What to do
Make sandy's seeded settings.json explicitly aware of CC's native sandbox rather than leaving it to chance — most likely sandbox.enabled: false in-container (sandy's container IS the boundary; the inner sandbox is redundant/conflicting — exactly the case enableWeakerNestedSandbox's own caveat describes). Use the same only-if-user-hasn't-set-it guard as the other seeded keys. Guard the choice with a run-tests.sh structural assertion.
Why it matters
This is the near-term, low-cost response to the one real strategic shift this quarter: the wrapped agent grew its own sandbox. Getting the coexistence right keeps sandy's egress isolation authoritative and avoids a confusing double-proxy UX.
Effort: S (one settings.json key + one test). No spike.
Source: Anthropic srt + Claude Code native sandboxing — Aug-2026 landscape pass (
research/sandbox-landscape-synthesis-2026-08.md§1/§4;research/INTEGRATION-OPPORTUNITIES-2026-08.md§1). Strategically timely.What
Claude Code now ships its own OS sandbox (
/sandbox,sandbox.*in settings.json) with its own HTTP/SOCKS egress proxy and anenableWeakerNestedSandboxmode for running inside Docker. Sandy already seeds settings.json every launch and points the agent's DNS at its own Go egress proxy. Two uncoordinated proxies can collide / double-prompt, and CC's/sandboxprompts +dangerouslyDisableSandboxfallback can muddy sandy's posture.What to do
Make sandy's seeded settings.json explicitly aware of CC's native sandbox rather than leaving it to chance — most likely
sandbox.enabled: falsein-container (sandy's container IS the boundary; the inner sandbox is redundant/conflicting — exactly the caseenableWeakerNestedSandbox's own caveat describes). Use the same only-if-user-hasn't-set-it guard as the other seeded keys. Guard the choice with arun-tests.shstructural assertion.Why it matters
This is the near-term, low-cost response to the one real strategic shift this quarter: the wrapped agent grew its own sandbox. Getting the coexistence right keeps sandy's egress isolation authoritative and avoids a confusing double-proxy UX.
Effort: S (one settings.json key + one test). No spike.