Sandboxing Claude Code, Codex, and Gemini CLI: what to check

The practical answer: Check the active sandbox and approval settings in the tool you actually run. Then try a harmless read outside the project, a harmless write outside it, and a network request to a domain you have not allowed. A permission prompt is not evidence that the underlying process is isolated. Repeat the check for each machine and execution mode your team uses.

I wrote this article in January after testing three coding CLIs. Their controls have changed since then, especially on Windows and around credentials. The table below reflects the vendor documentation reviewed on September 22, 2026. Your installed version and organization settings may differ.

Tool	Current starting point	Local boundary to inspect
Claude Code	Sandboxed Bash is opt-in through /sandbox or settings.	macOS Seatbelt; Linux and WSL2 use Bubblewrap. Native Windows has no sandboxed Bash.
Codex	The default local permissions mode applies sandboxing.	workspace-write confines routine changes to the workspace and asks before crossing its boundary; macOS, Linux/WSL2, and native Windows use different implementations.
Gemini CLI	Full-process sandboxing is opt-in, using --sandbox, GEMINI_SANDBOX, or settings.	macOS Seatbelt, a container, or another configured provider. The default macOS profile still allows broad reads and network access.

These are starting points, not guarantees. A team policy, a different profile, an unsandboxed retry, or a tool outside the sandbox can change what really runs.

Why a sandbox matters

A coding agent reads untrusted material while it works: repository files, dependency docs, search results, and tool output. Instructions inside that material can ask it to run a command or disclose a secret. The sandbox limits what a command can reach even if the agent makes a poor decision. Approval prompts add a separate decision point; they do not replace filesystem and network limits.

The two boundaries to inspect are filesystem access (what a command can read and write) and network access (where it can connect). Read access matters: a process that can read a private key or environment variable may be able to send it away through an allowed network path. Write access matters too: changing a shell startup file or executable can affect later, unsandboxed work.

Set up and verify each tool

Claude Code

Run /sandbox to inspect and choose a mode. The sandboxed Bash tool can write to the working directory and a session temp directory by default; a new network domain normally triggers a prompt. On Linux or WSL2, check that Bubblewrap and socat are available. Anthropic documents a fallback to unsandboxed commands when the sandbox cannot start, unless you set sandbox.failIfUnavailable: true. For a team that requires the boundary, also consider sandbox.allowUnsandboxedCommands: false in managed settings.

Claude's default read policy can still expose credential files and inherited environment variables. Its credential controls can deny files and unset or mask selected variables for sandboxed commands. Check the effective policy rather than assuming the word “sandbox” means secrets are hidden.

Codex

In the CLI, open /permissions. The documented local automation pairing is workspace-write with on-request approvals. read-only narrows local actions; danger-full-access removes the filesystem and network sandbox boundaries. The active profile matters more than a remembered default. On Linux and WSL2, current documentation calls for Bubblewrap; on Windows, Codex can use its native Windows sandbox or the Linux implementation in WSL2.

The Codex sandbox guide lists the configuration keys and writable-root settings. Check what directories are readable and writable, whether network access needs approval, and whether an automatic approval reviewer is enabled in your environment.

Gemini CLI

Start with gemini --sandbox, or set GEMINI_SANDBOX or tools.sandbox in settings. Choose the provider intentionally. On macOS, the documented permissive-open profile restricts writes but permits broad file reads and network access. A strict-* profile narrows reads; *-proxied profiles route network access through a proxy. Container providers mount the workspace, so review additional mounts and the container's credentials as well.

Gemini CLI also has tool-level sandboxing settings. Its sandbox guide and configuration reference describe separate controls; check both if your team relies on a specific policy.

Check your own environment

Use a disposable project and non-secret test files. Record the command, result, and effective settings for each tool and operating system.

1. Put a marker file outside the project. Ask the agent to read it, then to write a different marker outside the project. Record whether each action is blocked, prompted, or allowed.
2. Ask it to request a test domain that is not already allowed. Check the resulting request and any approval or proxy log. An allowed domain is not a guarantee that every path or account on that domain is safe.
3. Inspect which credentials the process inherits. Use fake values for this test. Check local secret files, environment variables, cloud profiles, and repository .env files separately.
4. Check escape paths: unsandboxed retries, shell commands you type yourself, MCP tools, browser tools, container mounts, and CI jobs. A sandbox for one command runner does not automatically cover every tool.
5. Review generated code and diffs before merge. Isolation limits the agent's immediate reach; it cannot establish that the code it writes has sound authorization or data handling.

If the agent is working on a customer system, agree on allowed repositories, data, test accounts, external services, and code-retention rules before giving it access. Keep production credentials out of the working environment unless the task truly needs them.

Where to go next

For a self-review, use the free security review planner to choose checks for your app and record evidence. If you need someone to investigate the code and configuration, verify findings, and help prioritize fixes, discuss a security review.

Sources

• Claude Code sandboxed Bash documentation
• Codex sandbox and permissions documentation
• Gemini CLI sandbox documentation
• Gemini CLI configuration reference