The sandbox issues on macOS
Issues the maintainers labelled both platform:macos and area:sandbox.
231 issues · 46 open · 185 resolved (80%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is converging. 69 new reports in the last 90 days vs 152 in the 90 before — -55%. The open backlog peaked at 62 in 2026-04 and sits at 46 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
141 of these reports name the Claude Code build they were running, spanning 89 releases. Heaviest reporters:
- Claude Code v2.1.71
- Claude Code v2.1.233
- Claude Code v2.1.150
- Claude Code v2.1.119
- Claude Code v2.1.80
- Claude Code v2.1.72
- Claude Code v2.1.201
- Claude Code v2.1.161
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 185 closures. Of the 185 closures with a recorded reason, 16% were closed as completed and 156 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
99 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Sandbox UI: tab cycling not working on /sandbox screen
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- Claude Desktop update breaks LAN SSH/network access (OPERON_SANDBOXED_NETWORK=1)
- [BUG] `sandbox.filesystem.allowWrite` setting has no effect on macOS Seatbelt sandbox
- [Bug] Sandbox profile E2BIG with many git worktrees due to unbounded ancestor rule expansion
- macOS sandbox unusable: Seatbelt profile passed inline via 'sandbox-exec -p' exceeds ARG_MAX with many git worktrees
- additionalDirectories setting does not grant Read tool access to files outside project
- [FEATURE] /sandbox command support in Claude Desktop app
- Claude desktop local-agent VM (claudevm.bundle/rootfs.img) grows unboundedly and is never reclaimed — silently fills disk, causes out-of-space failures
- Sandbox auto-adds config/ to denyWithinAllow, breaking git checkout across refs
- [BUG] Bash tool fails with spawn E2BIG — sandbox profile size scales with working-tree file count, gated by git-repo detection
- [BUG] macOS sandbox blocks `bind()` on Unix domain sockets for child processes, breaking `dotnet build` parallelism
- [BUG]Critical blocker (Max plan) — Claude Code shell bootstrap fails with ENOSPC
- Sandbox blocks macOS Security.framework trustd IPC, breaking all Go binaries (gh, terraform, tofu)
- [BUG] init-firewall.sh fails on duplicate IPs from DNS — container fails to start
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- [BUG] Sandbox git-internals write-protection resolves paths against the worktree root, not `.git/` — collaterally blocks a project's top-level `config/` dir
- [BUG] Preview server cannot read files from ~/Desktop on macOS despite Full Disk Access
- Sandbox TLS verification fails for gh CLI despite github.com in allowedHosts
- excludedCommands glob matching unsandboxes entire shell invocation, enabling sandbox escape via command chaining
- [BUG] Claude Code Destructive Action + Repeated User Interaction Failures
- [BUG] claude sometimes wants to use /tmp even though CLAUDE_CODE_TMPDIR is set in the environment
- [Feature Request] excludedCommands should also bypass Mach port / IPC restrictions for local app CLIs
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [BUG] No hook event fires for sandbox network permission popup in v2.1.120 (regression from v2.1.76)
- [BUG] Claude took liberties it really shouldn't with my global config
- [BUG] "Don't ask again" on unsandboxed prompt is a no-op
- [Bug] Sandbox blocks cwd-tracking writes on macOS, causing all bash commands to exit with code 1
- dangerouslyDisableSandbox: true does not prompt for user confirmation
- [Tahoe 26.x] terminal process tree EPERM in ~/Documents — root cause analysis & data
- Sandbox: allowedDomains not enforced for plain HTTP — only HTTPS CONNECT is filtered
- [BUG] Permissions error with git fsmonitor
- [BUG] Sandbox blocks writes to `.vscode/` and `.idea/` inside `node_modules/`, breaking `pnpm install`
- [BUG] Critical: sandbox.filesystem.denyRead does not prevent credential exposure
- sandbox.network.allowedDomains does not work for Node.js processes (DNS resolution blocked)
- WorktreeCreate hook fails with EPERM for repos under ~/Documents — hook spawned via 'disclaimer' shim loses the app's TCC Documents grant
- [Bug] Linked worktree sandbox auto-allow missing main .git directory and denyWithinAllow paths off-by-one
- MCP sandbox egress: allow <us2.make.com>
- [BUG] Artifacts and Scheduled Tasks fail when ~/Documents is a symlink (virtiofs cannot mkdir through symlinks)
- [Bug] Auto mode bypasses manual permission prompt for dangerouslyDisableSandbox commands
- [BUG] Write tool bypasses sandbox filesystem write restrictions that Bash tool correctly enforces
- [BUG] Bypassed global settings to read secret keys
- [BUG] sandbox: allowAllUnixSockets does not cover network-bind — tsx and other IPC servers fail with EPERM
- Bug: Sandbox half-broken — writes hit real filesystem, reads sandboxed — destroyed entire project
- [BUG] Sandbox blocks CoreSimulator mach-lookup, breaking iOS simulator tests
- [Bug] Sandbox mode unavailable on macOS - missing platform support
- [BUG] Bash tool cannot start: ENOSPC when creating /sessions/.../tmp/claude-XXXX (bootstrap deadlock)
- [BUG] Auto mode ran an unrequested wildcard `rm` in a user directory and deleted user files with no confirmation
- [Feature Request] macOS sandbox: auto-manage allowMachLookup for TLS/system services
- Auto mode hangs silently when a tool call is rejected by sandbox/permissions
- [BUG] dangerouslyDisableSandbox bypasses sandbox without prompting in auto-allow mode
- [BUG] Claude Code uses Linux sandbox (bwrap) instead of macOS Seatbelt when bwrap is installed via Homebrew (Apple Silicon, v2.1.71)
- iOS Simulator panel crash-loops on macOS 27 beta: seatbelt profile denies Metal's new cache-dir writes
- [BUG] Security: denyRead in sandbox not working
- macOS Tahoe: Claude Code 2.1.132+ writes block all non-Anthropic apps from reading files in ~/Documents (regression vs 2.1.128)
- [BUG] Claude settings JSON schema does not contain `sandbox.failIfUnavailable`
- [BUG] [Cowork] Scheduled-task sandboxes cannot mount Drive folder; Drive writes blocked at canonical AND Library/CloudStorage paths
- [BUG] sandbox.filesystem.allowWrite does not permit unlink / rm on macOS
- [BUG] $TMPDIR resolves to different paths between sandboxed and non-sandboxed Bash invocations
- [Bug] Sandbox blocks installation of dependencies containing `.idea` directories
- [BUG] Cowork crashes on startup: apply-seccomp Killed in VM sandbox (macOS ARM64)
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [BUG] HTTP 407 error for pretooluse http hook with authentication in sandbox
- [BUG] acli (Atlassian's official CLI tool) using OAuth fails in Claude Code but works in macOS Terminal
- [BUG] owork Domain allowlist UI not honored by sandbox proxy
- [BUG] Sandbox issue
- [Bug] Resume terminal session outputs minified JavaScript noise instead of error message
- [Bug] Sandbox write-deny on .claude/commands blocks git worktree/checkout for repos with tracked slash commands
- [BUG] Crash on startup: "sandbox required but unavailable" on macOS Tahoe 26.4
- sandbox.excludedCommands does not actually exempt listed commands from sandbox network enforcement
- Sandbox regression: macOS open command fails with procNotFound (-600)
- [BUG] Sandbox fails on macOS Tahoe (darwin25): zsh 5.9 accesses hw.* sysctls not whitelisted in sandbox profile
- [BUG] `excludedCommands` entries with `:*` suffix silently disable the entire sandbox for all Bash calls
- [BUG] preview_start fails on macOS — sandbox blocks os.getcwd(), launch.json ignored
- Sandbox blocks macOS SystemConfiguration API, crashing Rust-based CLI tools (Codex CLI)
- [BUG]Sandbox bypass: Claude Code writes outside sandbox after user denied Write permission
- [Bug] Jujutsu command fails in sandboxed environment with unsafe sandbox disable attempts
- Sandbox blocks unix socket creation at /tmp/ssh-* despite allowUnixSockets pattern
- [BUG] sandbox blocking IOKit GPU access on macOS / Metal.
- [BUG] No way to whitelist workspace directory in global sandbox settings
- [Bug] Claude Code bypassing sandbox restrictions
- [BUG] Title: Preview sandbox broken on macOS — EPERM uv_cwd
- [BUG] `gcloud` tool cannot be used in sandbox
- [Bug] Worktree isolation blocks all Bash commands due to parser abort in bash-command classifier
- [BUG] Claude Code CLI/Bash tool cannot access LAN devices on macOS — missing Info.plist/NSLocalNetworkUsageDescription, recurring across 5+ closed/locked issues, never fixed
- [BUG] Sandboxed Bash output corruption during git operations; direct git ref reads remain correct
- [BUG] sandbox.autoAllowBashIfSandboxed: true from server-managed settings is not applied — all non-allowlisted commands prompt
- 2.1.150 forces users into `dangerouslyDisableSandbox: true` for routine git-hook installs — security posture own-goal
- [Bug] `--help` flag not recognized, causing unintended command execution
- [BUG] macOS sandbox blocks JVM attach mechanism — Gradle/Mockito tests fail, sandboxed daemon contaminates terminal
- Sandbox fails to initialize on macOS 26 (Tahoe), forces dangerouslyDisableSandbox per call
- Sandbox blocks Unix domain socket IPC with credential managers (rbw/Bitwarden CLI)