Skip to content
Call wiki

Sandboxed or full-access: what isolation do coding agents really have?

Last updated 2026-08-17 · Confidence: documented — Anthropic’s Cowork architecture and Claude Code sandboxing docs, OpenAI’s Codex sandbox and permission docs.

Consumer coding agents span three isolation models — a separate virtual computer, an OS-enforced fence around your real system, and plain full access as your user account — and which one you get is a setting, not a fixed property of the product.

Three isolation models

Section titled “Three isolation models”
  • A separate computer. In Cowork, per the architecture overview, “code execution runs in an isolated virtual machine” — a dedicated Linux VM under the platform’s hypervisor — and “local file access is limited to folders the member has connected”. Its own portion of your computer, often a different OS, syncing only chosen folders (see Cowork sandbox).
  • A fence on your real machine. The Codex app and CLI run commands in your actual environment, but by default “inside a constrained environment instead of running with full access”: writes confined to the workspace (Seatbelt on macOS, bubblewrap and seccomp on Linux), network off until approved, and “when it needs to go beyond them, the approval flow takes over”.
  • Full access. Codex’s Full access preset “removes all sandbox restrictions and approval prompts” — OpenAI tags it elevated risk. Claude Code has no fence at all by default: commands run in your real shell, gated only by Permission modes; its opt-in Bash sandbox adds the same Seatbelt/bubblewrap isolation.

What full access means for risk

Section titled “What full access means for risk”

A full-access agent acts with your user account’s entire reach — every file you can read (SSH keys, credential files, browser profiles), every command, every network destination. Even a sandboxed setup can read broadly: Claude Code’s sandbox defaults to “read access to the entire computer”, credential files included, unless you deny those paths.

Isolation decides the blast radius when the agent misreads an ask — restore a folder versus rotate your credentials. How real the outside-attacker threat is, and what backstops help, is the subject of Agent safeguards. OpenAI’s own rule: “choose the narrowest profile that still lets the task complete”.

Sources

Section titled “Sources”