Issues

• Research notes: is srt written in Rust? (language composition) + platform-support matrix incl. Android/iOS status

  anthropics/sandbox-runtime#801 · Filter by author xeonai44 opened on Oct 31, 2026

• macOS: /usr/bin/diff fails with "Operation not permitted" on pipes and stdin — Apple diff writes to a hardcoded /tmp/diff.XXXXXXXX and ignores TMPDIR

  anthropics/sandbox-runtime#800 · Filter by author xiaoyu2er opened on Oct 31, 2026

• Body substitution deletes Content-Length per host, not per request — one short credential re-frames every bodied request to that host

  anthropics/sandbox-runtime#798 · Filter by author onesuper opened on Oct 31, 2026
  1

• Linux: allow Unix sockets without removing the seccomp helper (for sandboxes nested in srt)

  anthropics/sandbox-runtime#796 · Filter by author tappress opened on Oct 30, 2026

• Add an option to limit allowLocalBinding to loopback (127.0.0.1, ::1)

  anthropics/sandbox-runtime#795 · Filter by author itaizeilig-vi opened on Oct 30, 2026

• macOS Seatbelt: intra-workspace symlink write-deny omission in generateWriteRules and single-probe 'x' glob carve-out in denyGlobCovers

  anthropics/sandbox-runtime#790 · Filter by author inanna-malick opened on Oct 29, 2026

• Linux: relay chosen ports between the host and the sandbox's network namespace

  anthropics/sandbox-runtime#784 · Filter by author nmzz opened on Oct 25, 2026

• Question: What execution evidence can Sandbox Runtime provide for independent evaluation?

  anthropics/sandbox-runtime#783 · Filter by author ljefford2-cmyk opened on Oct 24, 2026
  2

• Disable Nagle's algorithm on the network proxy path

  anthropics/sandbox-runtime#779 · Filter by author trobanga opened on Oct 24, 2026

• zod ^3.25.0 dependency ships a copy affected by GHSA-mrhx-c7xc-m3w5 — please allow zod ^4.6.6 (imports already use zod/v3)

  anthropics/sandbox-runtime#778 · Filter by author gammadevinbot opened on Oct 24, 2026
  1

• listenInRange: on Windows a port held by another process gives EACCES, not EADDRINUSE, and the whole start fails

  anthropics/sandbox-runtime#773 · Filter by author Robinvliet opened on Oct 23, 2026

• Windows: no way to pass caller environment variables to the sandboxed child

  anthropics/sandbox-runtime#772 · Filter by author karljamoralin opened on Oct 23, 2026

• Windows: accept a per-exec allowWrite that narrows the session's write roots

  anthropics/sandbox-runtime#771 · Filter by author karljamoralin opened on Oct 23, 2026

• macOS: no way to extend the sysctl-read allowlist, default deny blocks some legitimate tools (.NET / Git Credential Manager)

  anthropics/sandbox-runtime#761 · Filter by author NikhilKalloli opened on Oct 21, 2026

• node-forge GHSA-86w9-cpqp-85rv (no patched version): consider replacing node-forge for MITM cert generation

  anthropics/sandbox-runtime#760 · Filter by author code-yeongyu opened on Oct 21, 2026

• HTTP proxy CONNECT tunnel truncates the response when the origin closes first

  anthropics/sandbox-runtime#756 · Filter by author johgu739 opened on Oct 20, 2026

• macOS: sandboxed commands can read login-keychain items; no setting denies the keychain services

  anthropics/sandbox-runtime#755 · Filter by author canopeego opened on Oct 20, 2026

• Masked credentials are not substituted in the URL query, so an API that takes its key only there can't be used

  anthropics/sandbox-runtime#752 · Filter by author mmmhoj opened on Oct 20, 2026

• Feature request: run the sandbox on a prepared root filesystem (Linux)

  anthropics/sandbox-runtime#750 · Filter by author albertvucinovic opened on Oct 20, 2026

• tlsTerminate: upstream leg ignores the parent proxy (HTTPS_PROXY), so TLS-terminated requests fail behind a proxy

  anthropics/sandbox-runtime#744 · Filter by author niksauer opened on Oct 19, 2026

• Linux: option for a read-only /proc/sys inside the sandbox (in bwrap's /proc and in apply-seccomp's own /proc)

  anthropics/sandbox-runtime#743 · Filter by author jayden1711 opened on Oct 18, 2026

• Linux: sandboxed commands can enumerate host accounts via /etc/passwd; denyRead breaks current-user lookup

  anthropics/sandbox-runtime#742 · Filter by author donnielrt opened on Oct 18, 2026

• Linux: Claude-specific mandatory denies create placeholder entries under cwd (11 /dev/null dotfiles, empty .claude/) that break git add -A for non-Claude consumers

  anthropics/sandbox-runtime#740 · Filter by author donnielrt opened on Oct 17, 2026
  1

• The ask callback cannot tell which invocation opened the connection

  anthropics/sandbox-runtime#734 · Filter by author ken-jo opened on Oct 16, 2026

• windows: wfp status reads installed with one block filter missing, and a plain install does not repair it

  anthropics/sandbox-runtime#723 · Filter by author blairducrayoppat opened on Oct 15, 2026
  1