Build environmental containment first — Anthropic's own numbers show model-layer defenses cannot hold the line

Anthropic Engineering·high signal

Anthropic reports classifiers catch roughly 83% of overeager behaviors before execution and Claude resists prompt injection at ~0.1% single-attempt success on Gray Swan benchmarks — and still concludes that model-layer defenses cannot stop a determined egress. Their ordering is explicit: environmental containment (sandbox, VM, egress proxy) first, model-layer second. The reasoning is that an egress proxy blocks the exfiltration POST regardless of the agent's intent, while a classifier only reduces the probability of intent.