Anthropic's red team phished its own staff into leaking AWS keys, 24/25

Containment as engineering, not vibes

Anthropic's thesis in the post is blunt: behavioral training is probabilistic, so the durable safety boundary is the environment — what the agent is able to reach, its "blast radius" (the maximum damage it could do). It maps three risks (user misuse, model misbehavior, external attacks like prompt injection) onto three layers (the environment, the model, external content), then shows three product patterns.

claude.ai runs code in ephemeral gVisor containers (a sandboxed kernel) — minimal blast radius, no persistent disk. Claude Code runs locally with shell access and originally gated writes and network calls on user approval. Claude Cowork, aimed at non-technical users, seals the agent inside a full hypervisor VM.

The numbers Anthropic chose to publish are the failures

The candor is in the metrics. Users approved roughly 93% of Claude Code permission prompts — approval fatigue gutting oversight — so Anthropic added OS-level sandboxes (Seatbelt on macOS, bubblewrap on Linux) that cut prompts by 84%. An internal red team phished an employee into pasting a prompt that asked Claude to exfiltrate AWS credentials; it succeeded 24 of 25 times, and only environmental egress controls blocked it. In Cowork, an attacker who planted an API key in a workspace file got Claude to upload files to the attacker's account through the allowed api.anthropic.com domain — fixed with an in-VM proxy that only accepts the VM's own session token.

Security engineers nod; skeptics smell an IPO

The people who build sandboxes for a living mostly agree with the architecture:

"Design for containment at the environment layer first, then steer behavior at the model layer." Umm... yeah?… The environment layer is deterministic; the model layer is probabilistic. If your only defense is "the model is well-behaved" you've bet your crown jewels on a coin that happens to land heads most of the time." — the author of the yoloAI containment tool

One reader had already gone looking under Cowork's hood and reports it's leakier than the marketing suggests — dumping the VM's environment variables, including its proxy ports and auto-memory flags:

"From inspecting the Cowork VM, the pollution is not documented and not controllable… It creates a lot of waste and frustration in the process." — a user who reverse-engineered the Cowork VM

And a security researcher points to a hole the post didn't cover:

"One attack they missed in the egress proxy is exfiltration via domain fronting… it might be fixed now." — David Buchanan, security researcher

Then the counter-narrative: that Anthropic is incentivized to make Claude sound scary.

"I'm intensely skeptical about anything Anthropic says, because they are so incented to make their products seem dangerous… ahead of their IPO… Remember the whole 'when threatened, the model would use an engineer's email to blackmail him'… That was just fan fiction." — a skeptic of Anthropic's threat framing

The honest part is the part that broke

Strip the framing debate and a useful rule survives: every interesting failure here was caught by the environment, not the model. The phished employee, the workspace-file key, the approval-fatigued user clicking yes 93% of the time — none were stopped by Claude being well-behaved. They were stopped by egress allowlists, proxies and VMs. The skeptics are right that danger talk sells ahead of an IPO; the engineers are right that the boring deterministic layer is the one doing the work.