The sandbox issues on macOS — page 2
Issues the maintainers labelled both platform:macos and area:sandbox.
325 issues · 109 open · 216 resolved (66%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is holding steady. 122 new reports in the last 90 days vs 103 in the 90 before — +18%. The open backlog peaked at 109 in 2026-10 and sits at 109 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
214 of these reports name the Claude Code build they were running, spanning 118 releases. Heaviest reporters:
- Claude Code v2.1.260
- Claude Code v2.1.71
- Claude Code v2.1.280
- Claude Code v2.1.278
- Claude Code v2.1.283
- Claude Code v2.1.259
- Claude Code v2.1.233
- Claude Code v2.1.150
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 216 closures. Of the 216 closures with a recorded reason, 17% were closed as completed and 180 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
135 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 325 matches; the statistics above cover all 325.
- [BUG] Crash on startup: "sandbox required but unavailable" on macOS Tahoe 26.4
- sandbox.excludedCommands does not actually exempt listed commands from sandbox network enforcement
- Sandbox regression: macOS open command fails with procNotFound (-600)
- [BUG] Sandbox fails on macOS Tahoe (darwin25): zsh 5.9 accesses hw.* sysctls not whitelisted in sandbox profile
- [DOCS] Sandbox settings missing `sandbox.network.allowMachLookup` documentation for macOS
- [BUG] `excludedCommands` entries with `:*` suffix silently disable the entire sandbox for all Bash calls
- [BUG] preview_start fails on macOS — sandbox blocks os.getcwd(), launch.json ignored
- Sandbox blocks macOS SystemConfiguration API, crashing Rust-based CLI tools (Codex CLI)
- [BUG]Sandbox bypass: Claude Code writes outside sandbox after user denied Write permission
- [Bug] Jujutsu command fails in sandboxed environment with unsafe sandbox disable attempts
- Sandbox blocks unix socket creation at /tmp/ssh-* despite allowUnixSockets pattern
- [BUG] sandbox blocking IOKit GPU access on macOS / Metal.
- [BUG] No way to whitelist workspace directory in global sandbox settings
- [Bug] Claude Code bypassing sandbox restrictions
- [BUG] Title: Preview sandbox broken on macOS — EPERM uv_cwd
- [BUG] `gcloud` tool cannot be used in sandbox
- Worktree-isolation Bash guard overrides an explicit PreToolUse `permissionDecision: allow`
- [BUG] Desktop worktree Write/Edit guard blocks files in a separate git repo nested under the base checkout
- [BUG] Browser pane blocks all subresources on private-network (RFC1918) LAN hosts with net::ERR_BLOCKED_BY_CLIENT - page never renders
- [Bug] Project-scope settings.json can bypass sandbox isolation via sandbox.enabled: false
- Bash tool: "wc" via command substitution fails with "command not found" inside a for-loop with 2+ items
- [BUG] Bash command containing `python3` execute without permission prompt when no allow rules are configured and sandboxed
- Regression (2.1.149 → 2.1.156): 1Password `op` CLI session broke in Bash tool calls on macOS
- 2.1.150 forces users into `dangerouslyDisableSandbox: true` for routine git-hook installs — security posture own-goal
- [Bug] `--help` flag not recognized, causing unintended command execution
- [BUG] macOS sandbox blocks JVM attach mechanism — Gradle/Mockito tests fail, sandboxed daemon contaminates terminal
- Sandbox fails to initialize on macOS 26 (Tahoe), forces dangerouslyDisableSandbox per call
- Sandbox blocks Unix domain socket IPC with credential managers (rbw/Bitwarden CLI)
- [Bug] RPC error: useradd failed when creating session directory in Cowork
- [BUG] Sandbox blocks OCSP/CRL certificate validation traffic, breaking HTTPS for allowed domains
- [BUG] Outbound Request to InfluxDB Blocked by Sandbox (2.1.74 -> v2.1.83 -> 2.1.74)
- [BUG] /sandbox shows Linux dependencies (bubblewrap/socat/seccomp) on macOS instead of Seatbelt
- [BUG] Sandbox blocks access to ~/.claude/shell-snapshots/, preventing all Bash commands from executing
- [BUG] Desktop Code tab: NODE_USE_SYSTEM_CA=1 in sandboxed Bash makes every Node TLS init print "failed to copy trust settings" errors; settings env can't override it
- [BUG] Browser pane treats NAT64 addresses (64:ff9b::/96) as private network, blocking every IPv4-only public site
- [FEATURE] Browser pane: let users trust local-dev domains that resolve to 127.0.0.1 (e.g. *.lndo.site, *.ddev.site)
- [Bug] sandbox.excludedCommands not respected for model-invoked shell commands
- Bash tool in a worktree-isolated agent refuses commands that never leave the worktree
- [BUG] Cowork local sandbox: proxy returns 403 'Connection blocked by network allowlist' for cdn.playwright.dev although it is in the session's default egressAllowedDomains
- Desktop app: local-agent-mode task sandboxes (~300MB each) never get cleaned up, disk fills up daily
- Auto mode's permission gate for dangerouslyDisableSandbox is blind to the flag itself
- [BUG] Project Deleted during Bash tool inconsistencies
- Sandboxed Go CLIs fail TLS verification: sandbox denies mach-lookup com.apple.trustd.agent
- [BUG] Bash output redirection and cp into the session's own cwd are blocked, while the error message lists that cwd as an allowed working directory
- [BUG] Sandbox blocks its own zsh `eval` wrapper — every Bash command fails with exit 126
- [BUG] Improper sandboxing
- [BUG] Sandbox network allowedDomains not enforced on macOS: built-in proxy CONNECTs to non-allowlisted hosts (CLI 2.1.205)
- [BUG] PreToolUse hook `permissionDecision: "ask"` is overridden by `auto` mode for benign `dangerouslyDisableSandbox` commands (contradicts documented hook precedence)
- [BUG] needed to remove domains in `init-firewall.sh` to launch dev container (Mac)
- [BUG] Cowork tool sandbox VM fails to start on macOS 26 — missing com.apple.vm.networking entitlement (v1.11847.5)
- Cowork sandbox (virtiofs bind-mount) silently drops git unlink() with EPERM, leaving stale tmp_obj_* files and .lock files on host
- [BUG]
- sandbox: per-project trusted-hooks allowlist — 2.1.150 denies all .git/hooks/ writes with no opt-out
- Bash sandbox blocks Go binaries' DNS resolution for hosts already on `allowedHosts`
- Bash tool SIGBUS in .claude/worktrees/ via Helpers/disclaimer provenance-pid chain (Claude Desktop 1.8089.1)
- Intermittent "Working directory was deleted" + EPERM on file ops when project lives under ~/Documents/Claude/* (macOS Tahoe)
- [BUG] Sandbox write allowlist does not match filenames containing .. (e.g. advisory-db..lock)
- [BUG]
- Tahoe regression #57024 expands: Claude Code's macl stamping now poisons sibling tool dirs (Cline) via parent propagation, breaking multi-harness backup pipelines
- Claude Desktop 1.3561.0: SSH remote workspaces blocked on LAN — OPERON_SANDBOXED_NETWORK=1 hardcoded with no opt-out
- [Feature Request] Make sandbox restrictions configurable
- [BUG] sandbox silently fails despite `failIfUnavailable` set to `true` in VSCode (Cursor) terminal
- Sandbox denyRead is bypassed by allowRead on parent directory and by Bash child processes
- preview_start always fails with 'No such file or directory' regardless of launch.json config
- [BUG] File read failure on macOS FileProvider-backed paths (Google Drive, iCloud, etc.)
- excludedCommands only bypasses read sandbox, not write/unlink
- [BUG] Claude Code's macOS sandbox blocks URLSession / CFNetwork
- [BUG] dangerouslyDisableSandbox executed without user approval after prior rejection
- preview_start fails with EPERM: uv_cwd on macOS
- excludedCommands: ["git"] does not fully bypass sandbox — SSH subprocess network access blocked
- [BUG] Sandbox silently disabled in SEA binary — ripgrep path resolution fails due to Bun-only detection in k1()/ZY()
- /sandbox command missing Mode/Overrides/Config tabs in native install
- [BUG] issue #19047
- [FEATURE] Allow configuration of custom sandbox profiles
- Cowork – Cannot create files/folders when workspace path contains accented characters (macOS)
- Sandbox additionalAllowedHosts does not apply to network requests
- [BUG] Mirror for improperly closed issue about dangling .cc-writes directories in project dir
- [Bug] Claude Code deleted my entire MacBook Applications directory contents - WTF
- [BUG] Diff panel (2.1.260) lists sandbox-unreadable files as changed, showing text files as "Binary file - cannot display diff"
- Worktree isolation: string-executing builtins (eval, enable) are matched in argument position — `echo eval` is refused
- [BUG] git shim hits xcode-select error inside sandbox
- [Bug] Sandbox file-read deny rule (.env*) not enforced for compound Bash commands in Agent-dispatched subagents
- [BUG] macOS: iOS Simulator sidecar aborts on every call — sandbox blocks its per-bundle-id Metal shader cache dir
- Killed sandboxed command leaks its SOCKS socket; main thread then spins on EPIPE at 100%+ CPU
- [BUG] sandbox.network.allowedDomains does not block egress — non-allowlisted hosts return 200 with real content (macOS)
- [BUG] Starting claude inside a sandbox deletes the session records of every other running session
- Unguarded `rm -rf` after a silently-failed `mv` causes irreversible data loss on a cloud-sync (file-provider) mount
- [Bug] Sandbox env exports UV_CACHE_DIR=~/.cache/uv with literal tilde, causing uv to create stray '~' directories in cwd
- [DOCS] Sandbox docs omit `sandbox.allowAppleEvents` macOS opt-in setting
- [BUG] Parser skipped input between top-level statements
- Sandboxed Bash intermittently strips Authorization header on HTTPS egress (gh CLI gets 401 "Requires authentication" despite valid keyring login)
- [BUG] pnpm lifecycle-script spawn rejected with EPERM under macOS sandbox; Node-direct spawn of same shell succeeds
- [FEATURE] Wire `sandbox.allowPty` from settings.json into the macOS Seatbelt profile (sandbox-runtime already supports it)
- Pasted/AirDropped file attachments land in unreadable sandbox path on macOS
- [BUG] Sandbox denies writes to shared .git inside a linked git worktree — git commit/add/push fail with EPERM, despite documented worktree allowance (v2.1.160)
- Bash tool silently strips -flag tokens when a command has a command substitution with a nested $
- [Feature] Allow mounting of `agent/memory/` subpath under Cowork session directory for subagents
- [BUG] Cowork Infrastructure Incident Report
- Sandbox: hardcoded deny on .idea/.vscode/.claude/.husky writes has no user override
- [FEATURE] /sandbox command support in Claude Desktop app