Issues

• Windows: initialize() runs srt-win acl grant/stamp/restore via spawnSync, blocking the host event loop for up to 60s

  anthropics/sandbox-runtime#647 · Filter by author karljamoralin opened on Oct 3, 2026

• External institutional authority binding for sandbox policy activation

  anthropics/sandbox-runtime#646 · Filter by author veraxis-protocol opened on Oct 2, 2026

• Linux: sandboxed TUI never receives SIGWINCH (bwrap --new-session), so it keeps its launch size

  anthropics/sandbox-runtime#642 · Filter by author IanSPoxon opened on Oct 2, 2026

• checkDependencies() ignores seccomp.applyPath when called before initialize()

  anthropics/sandbox-runtime#631 · Filter by author karljamoralin opened on Sep 29, 2026

• Windows: srt-win exec does not forward stdin to the sandboxed child (stdout works)

  anthropics/sandbox-runtime#623 · Filter by author webprodigies opened on Sep 28, 2026
  1

• Linux: the command can start before the in-sandbox socat listeners on 3128/1080 are bound, so its first proxied connection is refused

  anthropics/sandbox-runtime#616 · Filter by author denissajnar-qbit opened on Sep 27, 2026
  1

• Linux: automatic temporary-directory grants retain reads despite explicit denyRead

  anthropics/sandbox-runtime#611 · Filter by author henrymodisett opened on Sep 27, 2026

• HTTP proxy CONNECT tunnel truncates responses when the upstream closes the connection

  anthropics/sandbox-runtime#606 · Filter by author aciDrums7 opened on Sep 25, 2026
  3

• gVisor: another Linux sandbox option

  anthropics/sandbox-runtime#605 · Filter by author rexren-gif opened on Sep 25, 2026

• A single Ctrl-C reaches the sandboxed command twice; on Linux it kills the command even when it handles SIGINT

  anthropics/sandbox-runtime#603 · Filter by author carlostapiacl opened on Sep 24, 2026
  2

• srt exits 0 when the sandboxed command is killed by a signal

  anthropics/sandbox-runtime#602 · Filter by author carlostapiacl opened on Sep 24, 2026
  1

• macOS: getaddrinfo address sorting is denied as bare network-outbound (com.apple.netsrc kernel control)

  anthropics/sandbox-runtime#599 · Filter by author FerDev12 opened on Sep 23, 2026

• macOS: literal allowWrite paths are not canonicalized — a /tmp rule never matches /private/tmp

  anthropics/sandbox-runtime#596 · Filter by author hellsbellscw opened on Sep 22, 2026
  1

• cli: filesystem violations are never collected, and collected ones never reach a caller that runs the binary

  anthropics/sandbox-runtime#582 · Filter by author carlostapiacl opened on Sep 20, 2026

• macOS: a caller-supplied literal path containing […] compiles to a non-matching regex, silently voiding denyRead (and a glob-sniffed allowWrite loses its subtree)

  anthropics/sandbox-runtime#576 · Filter by author heavysixer opened on Sep 19, 2026
  1

• iokit-open on macOS is hardcoded to 3 classes with no config surface — blocks Metal (and likely other IOKit-backed device access)

  anthropics/sandbox-runtime#560 · Filter by author arleckk opened on Sep 17, 2026
  1

• Windows: local named pipes are both discoverable and reachable from the sandboxed process — no equivalent of allowUnixSockets/blocked-by-default for local IPC

  anthropics/sandbox-runtime#559 · Filter by author arleckk opened on Sep 17, 2026

• whichSync Node fallback folds timeout/ENOENT/EACCES into "Shell 'X' not found in PATH" — transient CPU starvation kills execs with a misleading error (absolute paths are not exempt)

  anthropics/sandbox-runtime#548 · Filter by author onesuper opened on Sep 14, 2026
  1

• filesystem: allow unlink/rename to be denied inside write-allowed paths

  anthropics/sandbox-runtime#545 · Filter by author carlostapiacl opened on Sep 13, 2026

• Attributed proxy usernames (srt.<encodedCommand>) conflict with Tirith userinfo checks

  anthropics/sandbox-runtime#544 · Filter by author kevinb361 opened on Sep 13, 2026

• Body substitution drops Content-Length for every request to a host with a short masked credential, breaking strict upload endpoints (GitHub release assets: 400 Bad Content-Length)

  anthropics/sandbox-runtime#543 · Filter by author AutoPasha opened on Sep 13, 2026
  1

• macOS: mandatory-deny globs match inside node_modules, denying writes the Linux path already exempts

  anthropics/sandbox-runtime#540 · Filter by author markhalliwell opened on Sep 12, 2026

• filterRequest denial destroys a still-uploading client's request, so the 403 and its reason are lost

  anthropics/sandbox-runtime#538 · Filter by author pfurini opened on Sep 12, 2026

• Linux violation monitor doesn't observe read-only opens (denyRead blocks are invisible to SandboxViolationStore)

  anthropics/sandbox-runtime#511 · Filter by author karljamoralin opened on Sep 1, 2026

• Secure mode never gives apply-seccomp CAP_SYS_ADMIN: --cap-drop ALL empties the bounding set, so the nested-userns fallback cannot work

  anthropics/sandbox-runtime#498 · Filter by author timkuijsten opened on Aug 27, 2026
  1