The sandbox issues on macOS — page 3
Issues the maintainers labelled both platform:macos and area:sandbox.
325 issues · 109 open · 216 resolved (66%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is holding steady. 122 new reports in the last 90 days vs 103 in the 90 before — +18%. The open backlog peaked at 109 in 2026-10 and sits at 109 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
214 of these reports name the Claude Code build they were running, spanning 118 releases. Heaviest reporters:
- Claude Code v2.1.260
- Claude Code v2.1.71
- Claude Code v2.1.280
- Claude Code v2.1.278
- Claude Code v2.1.283
- Claude Code v2.1.259
- Claude Code v2.1.233
- Claude Code v2.1.150
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 216 closures. Of the 216 closures with a recorded reason, 17% were closed as completed and 180 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
135 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 325 matches; the statistics above cover all 325.
- [BUG] Sandboxing doesnt work with directories named 'config'
- gh release upload of large files fails with "tls: bad record MAC" through Bash sandbox proxy
- [BUG] v2.1.137 macOS — Read/Bash on SMB-mounted volume returns EPERM without --add-dir, even with dangerouslyDisableSandbox=true
- [Cowork] Cannot git push to GitHub from sandbox (proxy 403); .git/index.lock strands after commits
- Compound `cd && cmd` hook: `git` flagged; `uv`, `find`, `alembic` not flagged
- [Bug] CLI sandbox intercepts writes to .claude/** even when --permission-prompt-tool grants permission
- [BUG] [Cowork] macOS Seatbelt blocks write to /sessions/.../tmp — Bash completely broken
- [BUG] can't run trunk with sandbox mode enabled
- [BUG] Project-local symlink to allowed external directory is still unusable
- [CRITICAL BUG] Cowork Mode Sandbox Overlay Silently Deletes All Existing Files in Mounted Directories
- [CRITICAL BUG] Cowork Mode Sandbox Overlay Silently Deletes All Existing Files in Mounted Directories
- [FEATURE] Support external container runtimes as an alternative to the bundled VM backend
- Sandbox blocks Unix domain socket creation in TMPDIR (/tmp/claude)
- [ENHANCEMENT] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- Bash tool: git add with multiple paths silently runs in background and holds index.lock indefinitely
- [BUG] /sandbox picker shows option 2 as (current) when runtime is option 1; picker selection appears to be no-op (v2.1.105)
- Dispatched agents with isolation="worktree" cannot Edit/Write files in their own worktree (.claude/worktrees denied by policy)
- Claude Code cannot establish TCP connections to local network hosts — No route to host (while iTerm2 succeeds)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [FEATURE] Enable media playback in Cowork artifact sandbox (video/audio/HLS)
- [BUG] `--settings` flag resolves sandbox filesystem paths relative to file, not project root
- [BUG] managed-settings sandbox.enabled: true causes all Bash tool output to be empty on macOS
- sandbox.filesystem.denyRead not enforced on bundled rg subprocess
- Security: bash -c wrapping bypasses .claude/ directory write protection
- [BUG] DenyRead/Write should take precedence over AllowRead/Write when there is a path match
- [Bug] Tool-scoped deny rules override sandbox network isolation at network level
- [BUG] Claude Code in Claude Desktop needs `/sandbox`.
- [BUG] Sandbox network prompt missing "No" option — causes infinite loop with retrying subprocesses
- [BUG] Sandbox silently reverts Edit tool writes on macOS
- [Bug] Sandbox bash execution fails with iconv_open UTF-8-MAC error in git operations
- [BUG] Agent ignores dangerouslyDisableSandbox retry rule on TLS certificate errors from gh CLI
- [BUG] Bash(mkdir) creating a folder with a "-" in the name failed
- [BUG] Subagent tools fail on /tmp/ worktree paths despite bypassPermissions and additionalDirectories
- [BUG] autoAllowBashIfSandboxed regression in v2.1.70+ VSCode extension — write commands prompt despite sandbox
- [BUG] Sandbox: bwrap: Can't bind mount /oldroot/ on /newroot/: Operation not permitted
- [BUG] Sandboxed Bash opens every existing sandbox.credentials.files path (4x each) on every command; floods file-access audit logs (macOS)
- Worktree-isolation guard refuses plain git commands after a PreToolUse hook wraps them in a launcher (rtk)
- [Bug] Incorrect harness classification for subdomain tooling
- [BUG] Running sessions lose all access to ~/Documents (macOS TCC) when a plugin's npx-launched MCP server is replaced on disk by a newer session
- Worktree-isolated sessions refuse git after `cd ~/path` but allow the same command with `"$HOME/path"` (2.1.278)
- [Bug] iOS Simulator input actions fail with sandbox: "Failed to initialize IO ports for device IO client"
- claude mcp add reports success when the config write is denied (sandboxed Bash)
- [BUG] Desktop preview_start fails for projects in ~/Documents on macOS: getcwd "Operation not permitted" despite Documents access (see #42914)
- Killed sandboxed command leaks its SOCKS socket; main thread then spins on EPIPE at 100%+ CPU
- Bash tool kills every command after ~5s ("output file was replaced or could no longer be verified") when an EDR transiently hard-links new files
- Cowork sandbox network allowlist not affected by sandbox.enabled toggle in settings
- [BUG] Sandboxed `mktemp -d` fails on macOS (ignores `$TMPDIR`); the empty variable made `rm -rf "$T"` run against the working directory with no critical-path prompt
- [BUG] macOS sandbox: System V shared-memory and sysctl calls are refused with EPERM whenever two sandboxed Bash commands run at the same time — and a refused shmget/shmctl still leaves the segment allocated
- Browser pane blocks cross-origin subresources of local multi-domain dev apps (ERR_BLOCKED_BY_CLIENT); Allowed sites list has no effect
- [Bug] Worktree isolation pin shared across parallel subagents causes cross-agent command execution
- Worktree-isolation guard refuses any non-simple Bash command, including commands containing no git at all
- Sandbox network egress allowlist not consistently enforced (non-allowlisted hosts intermittently reachable)
- Desktop app: git EPERM ('Unable to read current working directory') in session worktrees since ~Aug 10 — kills menu git status/history; FDA does not fix
- Sandbox blocks Go TLS on macOS: trustd Mach port inaccessible
- Write tool does not enforce the working-directory sandbox that Bash enforces
- Browser-pane dev-server launcher fails with EPERM (uv_cwd) -- sandboxed subprocess can't load an ad-hoc-signed native binary (Vite 8/Rolldown)
- [Bug] Claude Code: Destructive git operations executed without required sandbox bypass flags
- Go programs fail TLS verification through built-in proxy on macOS Tahoe (x509: OSStatus -26276)
- [Bug] Sandboxed Bash network broker hangs indefinitely on uncached host connections
- [BUG] Cowork (macOS): connected folders are no longer writable-mounted into the workspace sandbox since the new mandatory write-consent (~Jul 8, 2026) — device bridge works, but in-place editing is gone
- preview_start (Claude_Preview MCP) fails with sandbox getcwd error on Rails dev server
- [Feature Request] Temporary files should use workspace-local temp directory instead of /tmp
- preview_start: spawned children die with EPERM (uv_cwd / file open) for projects under Desktop paths with spaces — Bash tool works in same dir
- [Feature Request] Allow socket monitoring for traffic analysis use cases
- Workflow tool script sandbox does not expose globalThis.crypto
- Sandbox should create $TMPDIR directory automatically
- [BUG] vm_bundles/claudevm.bundle consumes ~10 GB on macOS, destroying available disk space
- Sandbox blocks macOS Keychain access, breaking CLI tools that use keyring auth (gh, bee)
- Seatbelt sandbox silently blocks all bash commands when denyRead is configured
- [BUG] macOS sandbox: every Bash call aborts in sandbox-exec (is_interned, intern.c:63) in a repo with many git worktrees; profile only rebuilt on settings reload
- [Bug] Duplicated Paragraphs in Responses; Reads Outside Allowed Directory Despite Hook Hardening
- [Bug] Auto mode suppresses stderr (2>/dev/null) on broad searches, hiding sandbox-denied access from user
- [BUG] Sandbox network allowlist not enforced after enabling the sandbox mid-session in auto mode (follow-up to #81572, still in 2.1.295)
- Sandbox proxy variables are set for excludedCommands (docs say no proxy); breaks gh TLS on macOS
- [BUG] Automated Generation of VM Bundle for Claude Code isolation cannot be prevented
- [FEATURE] Browser pane: let users trust public-TLD dev domains that resolve to loopback (Google OAuth rejects *.localhost and .test)
- Sandbox network proxy truncates the tail of streaming responses (kubectl exec/cp lose up to ~50 KB with "unexpected EOF")
- [BUG] macOS sandbox proxy truncates response bodies and resets the connection when the server closes it (`Connection: close`)
- [BUG] Sandboxed git push over SSH fails: local credential proxy requires auth that injected GIT_SSH_COMMAND's nc ProxyCommand can't provide
- [Bug] Subagent pkill command kills unrelated user processes with broad pattern matching
- [BUG] Sandbox: pnpm hangs forever when the project pins another pnpm version, and the write denial is never reported
- [BUG] macOS sandbox: git over SSH still fails in 2.1.284 — injected nc ProxyCommand sends no proxy credentials (fix proposal)
- git over SSH always fails when sandboxed: injected GIT_SSH_COMMAND ProxyCommand omits proxy credentials
- [BUG] claude plugin eval: context.add_dirs in case.yaml does not copy fixture files into the sandbox working directory
- [BUG] /sandbox exclude refused as "overridden by a higher-priority configuration" when the sandbox comes from --settings, even with no managed policy
- [Bug] macOS sandbox git over SSH fails due to unauthenticated SOCKS5 proxy
- After upgrade Claude code keeps trying to read outside the working directory
- [Bug] Anthropic API Error: Repeated Safety Filter Blocks on Valid Sandbox Configuration Requests
- Worktree-isolation Bash guard refuses a curl command that references a settings.json env var
- An earlier Claude Code session parked a whole build pass in a system temp folde…
- [BUG] Auto mode: every write through a user-created symlink prompts individually since 2.1.280, while the same file via its real path is auto-approved — no session-wide option
- [BUG] Cowork (macOS): sandbox VM never releases host file handles in mounted folders. Blocks OneDrive "Free Up Space" and the handle count grows without limit
- [Bug] Unexpected SSH host traversal in auto mode without confirmation
- [Feature Request] Sandbox execution environment breaking agent onboarding workflow
- Sandbox proxy credentials are sent to Git credential helpers on macOS (`fatal: failed to store: 100001`)
- [BUG] [Claude Desktop] [Cowork] Cowork sandbox cannot access local project folders on macOS
- Desktop app browser pane blocks subresources of sandboxed (null-origin) iframes with ERR_BLOCKED_BY_CLIENT
- [BUG] Worktree isolation guard blocks Edit/Write through a symlink the worktree setup itself created to share config with the main checkout
- [Bug] Unicode directory names converted to ASCII in sandbox operations