Match isolation strength to the user's capacity for oversight — and assume approval fatigue defeats human-in-the-loop

Anthropic Engineering·medium signal

Anthropic runs three different containment architectures for the same model family: ephemeral gVisor containers with seccomp for claude.ai, OS-level sandboxing (Seatbelt on macOS, bubblewrap on Linux) with human-in-the-loop for Claude Code, and a full hypervisor VM with the agent loop on the host for Cowork. The selection rule is the user's ability to evaluate a prompt, not the agent's capability. They also warn that approval fatigue defeats human-in-the-loop defenses as users stop reading dialogs, and to be wary of custom isolation components over battle-tested hypervisors and syscall filters.