The sandbox issues on macOS — page 2
Issues the maintainers labelled both platform:macos and area:sandbox.
231 issues · 46 open · 185 resolved (80%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is converging. 69 new reports in the last 90 days vs 152 in the 90 before — -55%. The open backlog peaked at 62 in 2026-04 and sits at 46 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
141 of these reports name the Claude Code build they were running, spanning 89 releases. Heaviest reporters:
- Claude Code v2.1.71
- Claude Code v2.1.233
- Claude Code v2.1.150
- Claude Code v2.1.119
- Claude Code v2.1.80
- Claude Code v2.1.72
- Claude Code v2.1.201
- Claude Code v2.1.161
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 185 closures. Of the 185 closures with a recorded reason, 16% were closed as completed and 156 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
99 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments).
- [Bug] RPC error: useradd failed when creating session directory in Cowork
- [DOCS] Sandbox settings missing `sandbox.network.allowMachLookup` documentation for macOS
- [BUG] Sandbox blocks OCSP/CRL certificate validation traffic, breaking HTTPS for allowed domains
- [BUG] Outbound Request to InfluxDB Blocked by Sandbox (2.1.74 -> v2.1.83 -> 2.1.74)
- [BUG] /sandbox shows Linux dependencies (bubblewrap/socat/seccomp) on macOS instead of Seatbelt
- [BUG] Sandbox blocks access to ~/.claude/shell-snapshots/, preventing all Bash commands from executing
- Worktree-isolation Bash guard refuses every compound command, even with no git usage at all
- [BUG] Browser pane blocks all subresources on private-network (RFC1918) LAN hosts with net::ERR_BLOCKED_BY_CLIENT - page never renders
- Sandboxed commands can't reach the macOS keychain, and the tools that need it blame the credential
- [Bug] Project-scope settings.json can bypass sandbox isolation via sandbox.enabled: false
- Bash tool: "wc" via command substitution fails with "command not found" inside a for-loop with 2+ items
- [BUG] needed to remove domains in `init-firewall.sh` to launch dev container (Mac)
- [BUG] Cowork tool sandbox VM fails to start on macOS 26 — missing com.apple.vm.networking entitlement (v1.11847.5)
- [BUG] Bash command containing `python3` execute without permission prompt when no allow rules are configured and sandboxed
- Regression (2.1.149 → 2.1.156): 1Password `op` CLI session broke in Bash tool calls on macOS
- Cowork sandbox (virtiofs bind-mount) silently drops git unlink() with EPERM, leaving stale tmp_obj_* files and .lock files on host
- [BUG]
- sandbox: per-project trusted-hooks allowlist — 2.1.150 denies all .git/hooks/ writes with no opt-out
- Bash sandbox blocks Go binaries' DNS resolution for hosts already on `allowedHosts`
- Bash tool SIGBUS in .claude/worktrees/ via Helpers/disclaimer provenance-pid chain (Claude Desktop 1.8089.1)
- Intermittent "Working directory was deleted" + EPERM on file ops when project lives under ~/Documents/Claude/* (macOS Tahoe)
- [BUG] Sandbox write allowlist does not match filenames containing .. (e.g. advisory-db..lock)
- [BUG]
- Tahoe regression #57024 expands: Claude Code's macl stamping now poisons sibling tool dirs (Cline) via parent propagation, breaking multi-harness backup pipelines
- Claude Desktop 1.3561.0: SSH remote workspaces blocked on LAN — OPERON_SANDBOXED_NETWORK=1 hardcoded with no opt-out
- [Feature Request] Make sandbox restrictions configurable
- [BUG] sandbox silently fails despite `failIfUnavailable` set to `true` in VSCode (Cursor) terminal
- Sandbox denyRead is bypassed by allowRead on parent directory and by Bash child processes
- preview_start always fails with 'No such file or directory' regardless of launch.json config
- [BUG] File read failure on macOS FileProvider-backed paths (Google Drive, iCloud, etc.)
- excludedCommands only bypasses read sandbox, not write/unlink
- [BUG] Claude Code's macOS sandbox blocks URLSession / CFNetwork
- [BUG] dangerouslyDisableSandbox executed without user approval after prior rejection
- preview_start fails with EPERM: uv_cwd on macOS
- excludedCommands: ["git"] does not fully bypass sandbox — SSH subprocess network access blocked
- [BUG] Sandbox silently disabled in SEA binary — ripgrep path resolution fails due to Bun-only detection in k1()/ZY()
- /sandbox command missing Mode/Overrides/Config tabs in native install
- [BUG] issue #19047
- [FEATURE] Allow configuration of custom sandbox profiles
- Cowork – Cannot create files/folders when workspace path contains accented characters (macOS)
- Sandbox additionalAllowedHosts does not apply to network requests
- sandbox.excludedCommands has no effect — excluded commands still run sandboxed (2.1.232, macOS)
- [BUG] git shim hits xcode-select error inside sandbox
- [BUG] Project Deleted during Bash tool inconsistencies
- Sandboxed Go CLIs fail TLS verification: sandbox denies mach-lookup com.apple.trustd.agent
- [BUG] Bash output redirection and cp into the session's own cwd are blocked, while the error message lists that cwd as an allowed working directory
- [BUG] Improper sandboxing
- [BUG] PreToolUse hook `permissionDecision: "ask"` is overridden by `auto` mode for benign `dangerouslyDisableSandbox` commands (contradicts documented hook precedence)
- [BUG] Sandbox denies writes to shared .git inside a linked git worktree — git commit/add/push fail with EPERM, despite documented worktree allowance (v2.1.160)
- Sandbox: hardcoded deny on .idea/.vscode/.claude/.husky writes has no user override
- [FEATURE] /sandbox command support in Claude Desktop app
- [BUG] Sandboxing doesnt work with directories named 'config'
- gh release upload of large files fails with "tls: bad record MAC" through Bash sandbox proxy
- [BUG] v2.1.137 macOS — Read/Bash on SMB-mounted volume returns EPERM without --add-dir, even with dangerouslyDisableSandbox=true
- [Cowork] Cannot git push to GitHub from sandbox (proxy 403); .git/index.lock strands after commits
- Compound `cd && cmd` hook: `git` flagged; `uv`, `find`, `alembic` not flagged
- [Bug] CLI sandbox intercepts writes to .claude/** even when --permission-prompt-tool grants permission
- [BUG] [Cowork] macOS Seatbelt blocks write to /sessions/.../tmp — Bash completely broken
- [BUG] can't run trunk with sandbox mode enabled
- [BUG] Project-local symlink to allowed external directory is still unusable
- [CRITICAL BUG] Cowork Mode Sandbox Overlay Silently Deletes All Existing Files in Mounted Directories
- [CRITICAL BUG] Cowork Mode Sandbox Overlay Silently Deletes All Existing Files in Mounted Directories
- [FEATURE] Support external container runtimes as an alternative to the bundled VM backend
- Sandbox blocks Unix domain socket creation in TMPDIR (/tmp/claude)
- [ENHANCEMENT] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- Bash tool: git add with multiple paths silently runs in background and holds index.lock indefinitely
- [BUG] /sandbox picker shows option 2 as (current) when runtime is option 1; picker selection appears to be no-op (v2.1.105)
- Dispatched agents with isolation="worktree" cannot Edit/Write files in their own worktree (.claude/worktrees denied by policy)
- Claude Code cannot establish TCP connections to local network hosts — No route to host (while iTerm2 succeeds)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [BUG] `--settings` flag resolves sandbox filesystem paths relative to file, not project root
- [BUG] managed-settings sandbox.enabled: true causes all Bash tool output to be empty on macOS
- sandbox.filesystem.denyRead not enforced on bundled rg subprocess
- Security: bash -c wrapping bypasses .claude/ directory write protection
- [BUG] DenyRead/Write should take precedence over AllowRead/Write when there is a path match
- [Bug] Tool-scoped deny rules override sandbox network isolation at network level
- [BUG] Claude Code in Claude Desktop needs `/sandbox`.
- [BUG] Sandbox network prompt missing "No" option — causes infinite loop with retrying subprocesses
- [BUG] Sandbox silently reverts Edit tool writes on macOS
- [Bug] Sandbox bash execution fails with iconv_open UTF-8-MAC error in git operations
- [BUG] Agent ignores dangerouslyDisableSandbox retry rule on TLS certificate errors from gh CLI
- [BUG] Bash(mkdir) creating a folder with a "-" in the name failed
- [BUG] Subagent tools fail on /tmp/ worktree paths despite bypassPermissions and additionalDirectories
- [BUG] autoAllowBashIfSandboxed regression in v2.1.70+ VSCode extension — write commands prompt despite sandbox
- [BUG] Sandbox: bwrap: Can't bind mount /oldroot/ on /newroot/: Operation not permitted
- [Bug] Worktree isolation pin shared across parallel subagents causes cross-agent command execution
- Worktree-isolation guard refuses any non-simple Bash command, including commands containing no git at all
- Desktop app: git EPERM ('Unable to read current working directory') in session worktrees since ~Aug 10 — kills menu git status/history; FDA does not fix
- [Bug] Sandbox file-read deny rule (.env*) not enforced for compound Bash commands in Agent-dispatched subagents
- [BUG] macOS: iOS Simulator sidecar aborts on every call — sandbox blocks its per-bundle-id Metal shader cache dir
- [BUG] sandbox.network.allowedDomains does not block egress — non-allowlisted hosts return 200 with real content (macOS)
- [BUG] Sandbox blocks its own zsh `eval` wrapper — every Bash command fails with exit 126
- [BUG] Sandbox network allowedDomains not enforced on macOS: built-in proxy CONNECTs to non-allowlisted hosts (CLI 2.1.205)
- [BUG] Starting claude inside a sandbox deletes the session records of every other running session
- preview_start: spawned children die with EPERM (uv_cwd / file open) for projects under Desktop paths with spaces — Bash tool works in same dir
- [Feature Request] Allow socket monitoring for traffic analysis use cases
- Workflow tool script sandbox does not expose globalThis.crypto
- Unguarded `rm -rf` after a silently-failed `mv` causes irreversible data loss on a cloud-sync (file-provider) mount