A permission prompt is a control with a decay curve built into it, because the more often the agent asks the more reliably the human clicks yes, so the 84 percent reduction Anthropic reports since it began iterating on this approach around October 2025, in Crypto Briefing's account of the rollout [6], reads better as repair to a broken control than as comfort for a tired developer. Roughly one prompt in six survives [1]. Those are the ones somebody might actually read.
The mechanism is duller than the number and more useful. Seatbelt on macOS [3] and bubblewrap on Linux and WSL2 [4] converge on the same two lines: filesystem access ends at the current working directory and its children, and outbound requests pass through a proxy that speaks only to pre-approved domains [5]. Draw those lines and the blast radius of a successful prompt injection [12] becomes the directory you invited the agent into plus whatever the allowlist can dial [3], with SSH keys, environment variables and browser cookies parked elsewhere on the machine sitting outside the line [7]. A boundary only needs reviewing once, where a prompt policy has to hold every few seconds.
Anthropic leaned on two operating-system primitives it does not own rather than shipping its own runtime, leaving Docker-based isolation as a supported third-party path [10], and full native Windows support is still absent [8], which in practice means containment on Windows hardware belongs to developers who do their work inside WSL2 [2].
Several readings of this rollout hold up. In the first, the sandbox profile becomes the auditable artifact that gets agentic coding through review, and the seat count follows the approval. In the second, the working directory turns out to be a generous boundary, since repositories hold credentials and allowlists hold package registries, and the first serious incident happens entirely inside the fence [3]. In the third, the interesting work drifts toward computer use, which Anthropic's own documentation places outside the sandbox [9], so the containment story never covers the surface that is growing fastest in a product pitched as a place where the model writes, tests and executes code on its own [13].
My view is a price-versus-value distinction rather than a forecast: 84 percent is a quote on friction removed, not on attempts contained [4], and the value on offer is that a security team can approve a configuration instead of trusting a judgment call made at two in the morning. I would be wrong if enterprise reviewers treat OS-level isolation as insufficient and keep mandating containers or disposable remote machines regardless, which is a live possibility precisely because Anthropic itself describes Docker as the more comprehensive separation [10]. What to watch is whether the next published number measures escapes instead of clicks.
