Securing Claude Agents: Sandboxing and Least Privilege (Claude Managed Agents Production)

An agent is software that takes actions on your behalf based partly on text it reads from the outside world. That sentence should make any security engineer nervous, because it means an attacker who controls some of that text — a web page the agent fetches, an email it reads, a file it ingests — can try to steer the agent's actions. Securing a Claude Managed Agent isn't about trusting the model more; it's about designing the system so that even a fully compromised reasoning step can't do real damage. You assume the agent can be tricked and you build so that being tricked is survivable.

This post covers the four pillars that matter most in practice: sandboxing what tools can do, enforcing least privilege on every capability, keeping secrets out of the model's reach, and defending the trust boundary against prompt injection.

The threat model: untrusted content meets real capabilities

Prompt injection is the defining agent vulnerability: malicious instructions hidden in content the agent processes — a comment on a page, hidden text in a document, a crafted tool result — that attempt to override the agent's actual instructions and make it take attacker-chosen actions. The danger scales with capability. An agent that can only summarize text can be made to summarize badly; an agent that can send email, move money, or delete records can be made to do those things to the wrong target.

So the core principle is to decouple the agent's trust from its power. Treat every byte the agent reads from the outside as untrusted, and make sure that the worst an untrusted instruction can achieve is bounded by capabilities you deliberately granted, not by whatever the model decided to do.

Least privilege, applied to agents, means each tool exposes the narrowest possible capability with the tightest possible scope, so a compromised reasoning step can only reach what that specific task genuinely requires.

Sandbox tool execution

Every tool call is code running on your infrastructure, often with arguments the model chose. Run it in a sandbox: an isolated execution environment — a container or microVM with no ambient credentials, a read-only filesystem except for an explicit scratch space, and egress locked to an allowlist of destinations the task actually needs. If the agent runs shell commands or generated code, that sandbox is the difference between a contained mistake and a breached host.

flowchart TD
  A["Claude emits tool call"] --> B{"Tool in allowlist?"}
  B -->|No| C["Reject, log, return error"]
  B -->|Yes| D{"Mutating or sensitive?"}
  D -->|No| E["Run in sandbox, scoped creds"]
  D -->|Yes| F["Require approval / second check"]
  F --> E
  E --> G["Validate & redact result"]
  G --> H["Return sanitized result to Claude"]

Network egress deserves special attention because it's the exfiltration path. An injected instruction that tells the agent to "send the contents of this file to attacker.example" fails harmlessly if the sandbox can only reach your own approved endpoints. Default-deny egress, then allow the specific hosts each tool needs. Apply the same logic to the filesystem: the agent should never have ambient write access to anything outside a disposable working directory.

Least privilege on every tool

Sandboxing contains execution; least privilege limits what each execution is allowed to do in the first place. Give each tool its own narrowly scoped credential rather than a shared admin key. A "look up order" tool should hold read-only access to the orders table and nothing else; a "refund" tool should be able to issue refunds up to a cap and nothing else. When you scope credentials per tool, a hijacked agent can only misuse the exact capabilities you handed it, not your whole platform.

Add a human-in-the-loop gate for high-consequence actions. Operations that move money, delete data, or contact customers at scale should require an approval step — either a human confirmation or an independent automated check that the action is within policy. This converts an irreversible mistake into a request you can deny. The cost is a little friction on the riskiest paths, which is exactly where you want friction.

Distinguish read tools from write tools explicitly in your design and your monitoring. The blast radius of a read is bounded by data sensitivity; the blast radius of a write is bounded by nothing unless you bound it. Reserve approval gates, rate limits, and tight scoping for the mutating tools.

Keep secrets out of the model

Secrets should never enter the context window. API keys, database passwords, and tokens belong in your execution layer, injected into tool calls at runtime — the model asks to "call the payments API," and your code attaches the credential; the key itself never appears in any prompt or response. This matters because anything in context can be echoed: a clever injection can ask the agent to repeat its instructions, and if a secret is sitting in the system prompt, it can leak.

The same goes for tool results. Redact sensitive fields before they re-enter the conversation — mask full card numbers, strip internal IDs the agent doesn't need, and avoid pouring raw credentials or PII back into context where they'll be resent on every subsequent turn and possibly surfaced to the user. Treat the context window as a place where everything is potentially observable, and keep secrets entirely outside it.

Defend the trust boundary against injection

You can't make injection impossible, so you make it ineffective. Several defenses compound. First, clearly delimit untrusted content in the prompt — wrap fetched documents or tool results in explicit markers and instruct Claude that anything inside is data to analyze, never instructions to follow. Second, keep the agent's authoritative instructions in the system prompt, which Claude weights as more trusted than conversational content. Third, and most importantly, lean on the structural defenses above: even if an injection succeeds in steering the model, least privilege and approval gates mean it can't reach anything dangerous.

Layer an output check on sensitive actions: before a mutating tool executes, run a quick validation — sometimes a second model call — asking whether this action is consistent with the user's actual request. Defense in depth is the whole game here. No single control is sufficient, but sandbox plus least privilege plus secret hygiene plus injection-aware prompting plus approval gates together reduce the realistic blast radius to something you can live with.

Frequently asked questions

What is prompt injection in an agent?

Prompt injection is when malicious instructions hidden in content the agent reads — a web page, document, or tool result — try to override its real instructions and make it take attacker-chosen actions. The defense isn't to trust the model more; it's to bound what any action can do through sandboxing, least privilege, and approval gates.

How do I protect secrets in a Claude agent?

Keep them out of the context window entirely. Store credentials in your execution layer and attach them to tool calls at runtime, so the key never appears in any prompt or response. Redact sensitive fields from tool results before they re-enter the conversation, since anything in context can be echoed.

Why does least privilege matter so much for agents?

Because the agent's reasoning can be manipulated, you must assume it might choose a harmful action. Scoping each tool to the narrowest credential and capability means a hijacked agent can only misuse exactly what that task needed, not your whole platform — turning a potential breach into a contained error.

Should every agent action require human approval?

No — only the high-consequence ones. Read-only lookups can run freely in a sandbox, but actions that move money, delete data, or contact customers at scale should pass an approval or independent policy check, converting an irreversible mistake into a request you can deny.

Hardened agents on your phone lines

CallSphere applies the same security posture — sandboxed tools, least-privilege credentials, and injection-aware design — to voice and chat agents that answer every call and message and act on tools safely in real time. See the hardened version live at callsphere.ai.

Source & attribution: This is an independent, original explainer inspired by Anthropic's coverage on the Claude blog. Claude, Claude Code, Claude Cowork, Claude Opus, and the Model Context Protocol are products and trademarks of Anthropic. CallSphere is not affiliated with or endorsed by Anthropic.