Recently, the Anthropic engineering team shared their experiences and lessons learned in building secure isolation systems while developing three AI products — claude.ai, Claude Code, and Claude Cowork. These three products are targeted at general users, developers, and enterprise users respectively, each with its own unique isolation strategy and risk model, but all following the core principle of "prioritizing isolation at the environment layer."

image.png

In claude.ai, aimed at general users, Anthropic adopted a temporary container solution based on gVisor. Whenever a user initiates a session, the system generates a temporary container, which is immediately destroyed once the session ends. This design ensures that interactions between users' AI are brief and secure, limiting resource access and capabilities, so that even if a risk event occurs, the impact is limited to a single session.

For developers, Claude Code uses an operating system-level sandbox mechanism to optimize the workflow. By default, developers cannot access the network when using it, which reduces frequent permission prompts and significantly improves the user experience. According to statistics, this design reduced the frequency of permission prompts by 84%. When developers need network access, they can temporarily open it through explicit authorization.

For enterprise users who require the highest level of security, Claude Cowork uses a virtual machine-level isolation scheme to ensure complete separation from the host system. While this approach provides the best security, it also reduces integration with the host system and presents new challenges for security monitoring.

The article also mentioned several security incidents, the most notable being prompt injection through phishing attacks. In 24 tests, the success rate was as high as 96%. Additionally, there were issues such as data theft through API keys controlled by attackers. These incidents have prompted Anthropic to continuously improve its security architecture.

Anthropic summarized three key principles: first, prioritize isolation at the environment layer, guide at the model layer; second, the intensity of isolation should match the user's supervisory capability; third, be vigilant about defining components. These principles not only guide the design of Anthropic's products but also provide important warnings for the entire industry.

Key Points:   

🔒 Prioritize Isolation at the Environment Layer: Different products use different isolation strategies to enhance security.  

🛠️ Clear Role Definition: claude.ai, Claude Code, and Claude Cowork are designed for general users, developers, and enterprise users respectively.  

⚠ Security Incident Warnings: High success rates of phishing attacks were found in practical tests, prompting continuous improvement of security measures.