Issues

• macOS: reset() resolves before the log stream monitor has exited

  anthropics/sandbox-runtime#812 · Filter by author Exelord opened on Nov 7, 2026

• macOS: a masked credential is readable from the parent process's environment via sysctl KERN_PROCARGS2

  anthropics/sandbox-runtime#811 · Filter by author dfox288 opened on Nov 6, 2026

• macOS: the log stream violation monitor outlives its process on SIGKILL and SIGHUP; SIGINT/SIGTERM are swallowed

  anthropics/sandbox-runtime#809 · Filter by author crtgregoric opened on Nov 5, 2026

• macOS: allowAllUnixSockets lets a sandboxed process connect to a socket under denyRead

  anthropics/sandbox-runtime#808 · Filter by author carlostapiacl opened on Nov 4, 2026

• macOS log monitor drops all but the first violation in each log stream chunk, and can attribute it to the wrong command

  anthropics/sandbox-runtime#806 · Filter by author crtgregoric opened on Nov 2, 2026

• macOS: let an embedder add sandbox rules (deny process-exec, LaunchServices toggle)

  anthropics/sandbox-runtime#805 · Filter by author itaizeilig-vi opened on Nov 2, 2026

• Windows: curl HTTPS fails inside the sandbox with schannel SEC_E_NO_CREDENTIALS

  anthropics/sandbox-runtime#804 · Filter by author vincekent opened on Nov 2, 2026

• Windows: Python tempfile.mkdtemp() hangs inside the sandbox

  anthropics/sandbox-runtime#803 · Filter by author vincekent opened on Nov 2, 2026

• Research notes: is srt written in Rust? (language composition) + platform-support matrix incl. Android/iOS status

  anthropics/sandbox-runtime#801 · Filter by author xeonai44 opened on Oct 31, 2026

• macOS: /usr/bin/diff fails with "Operation not permitted" on pipes and stdin — Apple diff writes to a hardcoded /tmp/diff.XXXXXXXX and ignores TMPDIR

  anthropics/sandbox-runtime#800 · Filter by author xiaoyu2er opened on Oct 31, 2026

• Body substitution deletes Content-Length per host, not per request — one short credential re-frames every bodied request to that host

  anthropics/sandbox-runtime#798 · Filter by author onesuper opened on Oct 31, 2026
  2

• Linux: allow Unix sockets without removing the seccomp helper (for sandboxes nested in srt)

  anthropics/sandbox-runtime#796 · Filter by author tappress opened on Oct 30, 2026

• Add an option to limit allowLocalBinding to loopback (127.0.0.1, ::1)

  anthropics/sandbox-runtime#795 · Filter by author itaizeilig-vi opened on Oct 30, 2026

• macOS Seatbelt: intra-workspace symlink write-deny omission in generateWriteRules and single-probe 'x' glob carve-out in denyGlobCovers

  anthropics/sandbox-runtime#790 · Filter by author inanna-malick opened on Oct 29, 2026

• Linux: relay chosen ports between the host and the sandbox's network namespace

  anthropics/sandbox-runtime#784 · Filter by author nmzz opened on Oct 25, 2026
  1

• Question: What execution evidence can Sandbox Runtime provide for independent evaluation?

  anthropics/sandbox-runtime#783 · Filter by author ljefford2-cmyk opened on Oct 24, 2026
  6

• Disable Nagle's algorithm on the network proxy path

  anthropics/sandbox-runtime#779 · Filter by author trobanga opened on Oct 24, 2026

• zod ^3.25.0 dependency ships a copy affected by GHSA-mrhx-c7xc-m3w5 — please allow zod ^4.6.6 (imports already use zod/v3)

  anthropics/sandbox-runtime#778 · Filter by author gammadevinbot opened on Oct 24, 2026
  1

• listenInRange: on Windows a port held by another process gives EACCES, not EADDRINUSE, and the whole start fails

  anthropics/sandbox-runtime#773 · Filter by author Robinvliet opened on Oct 23, 2026

• Windows: no way to pass caller environment variables to the sandboxed child

  anthropics/sandbox-runtime#772 · Filter by author karljamoralin opened on Oct 23, 2026

• Windows: accept a per-exec allowWrite that narrows the session's write roots

  anthropics/sandbox-runtime#771 · Filter by author karljamoralin opened on Oct 23, 2026

• macOS: no way to extend the sysctl-read allowlist, default deny blocks some legitimate tools (.NET / Git Credential Manager)

  anthropics/sandbox-runtime#761 · Filter by author NikhilKalloli opened on Oct 21, 2026

• node-forge GHSA-86w9-cpqp-85rv (no patched version): consider replacing node-forge for MITM cert generation

  anthropics/sandbox-runtime#760 · Filter by author code-yeongyu opened on Oct 21, 2026

• HTTP proxy CONNECT tunnel truncates the response when the origin closes first

  anthropics/sandbox-runtime#756 · Filter by author johgu739 opened on Oct 20, 2026

• macOS: sandboxed commands can read login-keychain items; no setting denies the keychain services

  anthropics/sandbox-runtime#755 · Filter by author canopeego opened on Oct 20, 2026