The sandbox issues on macOS — page 3
Issues the maintainers labelled both platform:macos and area:sandbox.
231 issues · 46 open · 185 resolved (80%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is converging. 69 new reports in the last 90 days vs 152 in the 90 before — -55%. The open backlog peaked at 62 in 2026-04 and sits at 46 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
141 of these reports name the Claude Code build they were running, spanning 89 releases. Heaviest reporters:
- Claude Code v2.1.71
- Claude Code v2.1.233
- Claude Code v2.1.150
- Claude Code v2.1.119
- Claude Code v2.1.80
- Claude Code v2.1.72
- Claude Code v2.1.201
- Claude Code v2.1.161
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 185 closures. Of the 185 closures with a recorded reason, 16% were closed as completed and 156 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
99 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- …n macOS) will fail in the sandbox. is the most common case. Workaround is per command, but this bypasses all sandbox restrictions rather than just the mach service needed for TLS. Environment - macOS 15.3 (Darwin 25.2.0)…
Found in the description of #29533 · resolved - 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- …y: (Mach-O arm64, Bun-bundled) - Shell: zsh - : enabled - : Workaround Pin to 2.1.119: Asks 1. The actual returned by on the failing machine would be the most useful next data point — currently the value is truncated in…
Found in the description of #53085 · resolved - [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- …s. The proxy is requiring an auth method nc cannot satisfy. Workaround: before launching Claude Code bypasses the proxy injection.
Found in the description of #70684 · still open - [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- Workaround Installing ripgrep fixes this: revealed as the underlying cause. On our system, existed only as a Claude Code shell function shim — not as a standalone binary — so the sandbox dependency check failed silently.…
Found in the thread of #31804 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–231
Ranked by community engagement (reactions weighted over comments).
- [Bug] Sandbox env exports UV_CACHE_DIR=~/.cache/uv with literal tilde, causing uv to create stray '~' directories in cwd
- [DOCS] Sandbox docs omit `sandbox.allowAppleEvents` macOS opt-in setting
- [BUG] Parser skipped input between top-level statements
- Sandboxed Bash intermittently strips Authorization header on HTTPS egress (gh CLI gets 401 "Requires authentication" despite valid keyring login)
- [BUG] pnpm lifecycle-script spawn rejected with EPERM under macOS sandbox; Node-direct spawn of same shell succeeds
- [FEATURE] Wire `sandbox.allowPty` from settings.json into the macOS Seatbelt profile (sandbox-runtime already supports it)
- Pasted/AirDropped file attachments land in unreadable sandbox path on macOS
- Bash tool silently strips -flag tokens when a command has a command substitution with a nested $
- [Feature] Allow mounting of `agent/memory/` subpath under Cowork session directory for subagents
- [BUG] Cowork Infrastructure Incident Report
- Sandbox should create $TMPDIR directory automatically
- [BUG] vm_bundles/claudevm.bundle consumes ~10 GB on macOS, destroying available disk space
- Sandbox blocks macOS Keychain access, breaking CLI tools that use keyring auth (gh, bee)
- Seatbelt sandbox silently blocks all bash commands when denyRead is configured
- [BUG] sandbox.network.strictAllowlist is silently discarded from project settings — no warning at startup, in --debug, /status, /sandbox, or doctor
- [BUG] Bash sandbox: TCC attribution fails for the live claude process (stale audit token), Documents access lost until TCC toggle
- EnterWorktree mid-session breaks Stop-hook execution (sandbox scope not updated, EPERM)
- Sandbox policy covers Bash only; Write and WebFetch are not gated by it
- Auto mode's permission gate for dangerouslyDisableSandbox is blind to the flag itself
- Sandbox network egress allowlist not consistently enforced (non-allowlisted hosts intermittently reachable)
- Worktree isolation: string-executing builtins (eval, enable) are matched in argument position — `echo eval` is refused
- Sandbox blocks Go TLS on macOS: trustd Mach port inaccessible
- Write tool does not enforce the working-directory sandbox that Bash enforces
- Browser-pane dev-server launcher fails with EPERM (uv_cwd) -- sandboxed subprocess can't load an ad-hoc-signed native binary (Vite 8/Rolldown)
- [Bug] Claude Code: Destructive git operations executed without required sandbox bypass flags
- Killed sandboxed command leaks its SOCKS socket; main thread then spins on EPIPE at 100%+ CPU
- Go programs fail TLS verification through built-in proxy on macOS Tahoe (x509: OSStatus -26276)
- [Bug] Sandboxed Bash network broker hangs indefinitely on uncached host connections
- [BUG] Cowork (macOS): connected folders are no longer writable-mounted into the workspace sandbox since the new mandatory write-consent (~Jul 8, 2026) — device bridge works, but in-place editing is gone
- preview_start (Claude_Preview MCP) fails with sandbox getcwd error on Rails dev server
- [Feature Request] Temporary files should use workspace-local temp directory instead of /tmp