The sandbox issues on macOS
Issues the maintainers labelled both platform:macos and area:sandbox.
325 issues · 109 open · 216 resolved (66%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is holding steady. 122 new reports in the last 90 days vs 103 in the 90 before — +18%. The open backlog peaked at 109 in 2026-10 and sits at 109 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
214 of these reports name the Claude Code build they were running, spanning 118 releases. Heaviest reporters:
- Claude Code v2.1.260
- Claude Code v2.1.71
- Claude Code v2.1.280
- Claude Code v2.1.278
- Claude Code v2.1.283
- Claude Code v2.1.259
- Claude Code v2.1.233
- Claude Code v2.1.150
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 216 closures. Of the 216 closures with a recorded reason, 17% were closed as completed and 180 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
135 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 325 matches; the statistics above cover all 325.
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- Sandbox UI: tab cycling not working on /sandbox screen
- Claude desktop local-agent VM (claudevm.bundle/rootfs.img) grows unboundedly and is never reclaimed — silently fills disk, causes out-of-space failures
- [Bug] Auto mode still prompts for grep tool authorization despite being in Auto Mode
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- Read() deny rules force manual approval on unrelated Bash grep commands after cd with relative glob
- [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- Claude Desktop 3p + custom gateway (`ANTHROPIC_BASE_URL`): sandbox network pinned to gateway + api.anthropic.com, `sandbox.network.allowedDomains` ignored even after full app restart
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- Claude Desktop update breaks LAN SSH/network access (OPERON_SANDBOXED_NETWORK=1)
- [Bug] Sandbox profile E2BIG with many git worktrees due to unbounded ancestor rule expansion
- macOS sandbox unusable: Seatbelt profile passed inline via 'sandbox-exec -p' exceeds ARG_MAX with many git worktrees
- [BUG] `sandbox.filesystem.allowWrite` setting has no effect on macOS Seatbelt sandbox
- sandbox.excludedCommands has no effect — excluded commands still run sandboxed (2.1.232, macOS)
- Sandbox auto-adds config/ to denyWithinAllow, breaking git checkout across refs
- additionalDirectories setting does not grant Read tool access to files outside project
- `grep -r` with `--include` filters falsely triggers `Read(.env)` deny prompt (v2.1.259) — breaks every recursive search
- [BUG] Bash tool fails with spawn E2BIG — sandbox profile size scales with working-tree file count, gated by git-repo detection
- sandbox.excludedCommands has no effect: listed commands still run sandboxed
- [FEATURE] /sandbox command support in Claude Desktop app
- [BUG] 2.1.278: a file redirection on a single excluded command defeats sandbox.excludedCommands (gh fails TLS)
- [Tahoe 26.x] terminal process tree EPERM in ~/Documents — root cause analysis & data
- [BUG] macOS sandbox blocks `bind()` on Unix domain sockets for child processes, breaking `dotnet build` parallelism
- [BUG]Critical blocker (Max plan) — Claude Code shell bootstrap fails with ENOSPC
- Sandbox blocks macOS Security.framework trustd IPC, breaking all Go binaries (gh, terraform, tofu)
- [BUG] init-firewall.sh fails on duplicate IPs from DNS — container fails to start
- [BUG] Sandbox git-internals write-protection resolves paths against the worktree root, not `.git/` — collaterally blocks a project's top-level `config/` dir
- [BUG] Preview server cannot read files from ~/Desktop on macOS despite Full Disk Access
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- Worktree-isolation Bash guard refuses every compound command, even with no git usage at all
- Sandbox TLS verification fails for gh CLI despite github.com in allowedHosts
- excludedCommands glob matching unsandboxes entire shell invocation, enabling sandbox escape via command chaining
- [BUG] Claude Code Destructive Action + Repeated User Interaction Failures
- [BUG] claude sometimes wants to use /tmp even though CLAUDE_CODE_TMPDIR is set in the environment
- Sandbox creates empty `.claude/.cc-writes/` dirs in nested subfolders when working directory changes
- [Feature Request] excludedCommands should also bypass Mach port / IPC restrictions for local app CLIs
- `claude plugin eval` refuses every Bash-granting run on a Mac with Docker Desktop (symlinks in ~/.docker/cli-plugins)
- [BUG] Cowork macOS: local sandbox VM starts with NO network route (only loopback) and cloud egress proxy returns 403 for every domain, despite "Allow network egress: All domains" — regression since 2026-09-10 ~23:15 UTC
- [BUG] No hook event fires for sandbox network permission popup in v2.1.120 (regression from v2.1.76)
- [BUG] Claude took liberties it really shouldn't with my global config
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [BUG] "Don't ask again" on unsandboxed prompt is a no-op
- [Bug] Sandbox blocks cwd-tracking writes on macOS, causing all bash commands to exit with code 1
- dangerouslyDisableSandbox: true does not prompt for user confirmation
- [BUG] Bash sandbox: TCC attribution fails for the live claude process (stale audit token), Documents access lost until TCC toggle
- Sandbox: allowedDomains not enforced for plain HTTP — only HTTPS CONNECT is filtered
- [BUG] Permissions error with git fsmonitor
- Sandboxed commands can't reach the macOS keychain, and the tools that need it blame the credential
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- WorktreeCreate hook fails with EPERM for repos under ~/Documents — hook spawned via 'disclaimer' shim loses the app's TCC Documents grant
- MCP sandbox egress: allow <us2.make.com>
- [BUG] Sandbox blocks writes to `.vscode/` and `.idea/` inside `node_modules/`, breaking `pnpm install`
- [BUG] Critical: sandbox.filesystem.denyRead does not prevent credential exposure
- sandbox.network.allowedDomains does not work for Node.js processes (DNS resolution blocked)
- iOS Simulator panel crash-loops on macOS 27 beta: seatbelt profile denies Metal's new cache-dir writes
- [BUG] Claude Code CLI/Bash tool cannot access LAN devices on macOS — missing Info.plist/NSLocalNetworkUsageDescription, recurring across 5+ closed/locked issues, never fixed
- [BUG] Auto mode ran an unrequested wildcard `rm` in a user directory and deleted user files with no confirmation
- [Bug] Linked worktree sandbox auto-allow missing main .git directory and denyWithinAllow paths off-by-one
- [BUG] Artifacts and Scheduled Tasks fail when ~/Documents is a symlink (virtiofs cannot mkdir through symlinks)
- [Bug] Auto mode bypasses manual permission prompt for dangerouslyDisableSandbox commands
- [BUG] Write tool bypasses sandbox filesystem write restrictions that Bash tool correctly enforces
- [BUG] Bypassed global settings to read secret keys
- [BUG] sandbox: allowAllUnixSockets does not cover network-bind — tsx and other IPC servers fail with EPERM
- Bug: Sandbox half-broken — writes hit real filesystem, reads sandboxed — destroyed entire project
- [BUG] Sandbox blocks CoreSimulator mach-lookup, breaking iOS simulator tests
- [Bug] Sandbox mode unavailable on macOS - missing platform support
- [BUG] Bash tool cannot start: ENOSPC when creating /sessions/.../tmp/claude-XXXX (bootstrap deadlock)
- Bash tool refuses read-only and worktree-local commands as 'too complex to verify' in git worktree isolation
- [Feature Request] macOS sandbox: auto-manage allowMachLookup for TLS/system services
- Auto mode hangs silently when a tool call is rejected by sandbox/permissions
- [BUG] dangerouslyDisableSandbox bypasses sandbox without prompting in auto-allow mode
- [BUG] Claude Code uses Linux sandbox (bwrap) instead of macOS Seatbelt when bwrap is installed via Homebrew (Apple Silicon, v2.1.71)
- [Bug] Worktree isolation guard false positive: substring match on "git" blocks commands
- [BUG] Sandboxed Bash tool blocks .git writes (refs/heads, index.lock) despite filesystem.allowWrite/excludedCommands overrides
- [BUG] HTTP 407 error for pretooluse http hook with authentication in sandbox
- [BUG] acli (Atlassian's official CLI tool) using OAuth fails in Claude Code but works in macOS Terminal
- [BUG] Security: denyRead in sandbox not working
- [BUG] owork Domain allowlist UI not honored by sandbox proxy
- macOS Tahoe: Claude Code 2.1.132+ writes block all non-Anthropic apps from reading files in ~/Documents (regression vs 2.1.128)
- [BUG] Claude settings JSON schema does not contain `sandbox.failIfUnavailable`
- [BUG] [Cowork] Scheduled-task sandboxes cannot mount Drive folder; Drive writes blocked at canonical AND Library/CloudStorage paths
- [BUG] sandbox.filesystem.allowWrite does not permit unlink / rm on macOS
- [BUG] $TMPDIR resolves to different paths between sandboxed and non-sandboxed Bash invocations
- [Bug] Sandbox blocks installation of dependencies containing `.idea` directories
- [BUG] Cowork crashes on startup: apply-seccomp Killed in VM sandbox (macOS ARM64)
- Worktree-isolated sessions still refuse Bash commands that never run git (2.1.270)
- Cowork Desktop: local "Additional allowed domains" / "All domains" egress stopped being enforced after 2026-09-11 update (VM 2.1.260 worked, 2.1.266 blocks)
- `claude plugin eval` refuses every Bash-granting evaluation under Docker Desktop's default `~/.docker` layout; `DOCKER_CONFIG` does not bypass
- [FEATURE] Directory allowlist / default-deny support for Read/Write/Edit tools (currently only Bash has real sandboxing)
- [Bug] Worktree isolation blocks all Bash commands due to parser abort in bash-command classifier
- [BUG] Sandboxed Bash output corruption during git operations; direct git ref reads remain correct
- [BUG] sandbox.autoAllowBashIfSandboxed: true from server-managed settings is not applied — all non-allowlisted commands prompt
- [BUG] Sandbox issue
- [Bug] Resume terminal session outputs minified JavaScript noise instead of error message
- [Bug] Sandbox write-deny on .claude/commands blocks git worktree/checkout for repos with tracked slash commands