What Happens When You Lock Claude in a macOS Sandbox

Have you ever noticed that all development environments and AI apps on macOS run without a sandbox? That’s understandable, as a developer or an AI you want as much access to all your data as possible. But some of that data deserves protection: first and foremost the private keys of your SSH accounts, but also customer data, or simply your emails, photos and documents.Apple introduced the system’s own sandbox for exactly this purpose. It goes by the codename “Seatbelt” and is known on the command line as sandbox-exec. It has been around for many years and is a requirement for every app distributed through Apple’s App Store. Wouldn’t it be nice if tools like Claude (Anthropic), Gemini (Google), Copilot (GitHub), Codex (OpenAI) and the rest could run in a tailor-made sandbox?I tried it. It produced an app, and along the way a few insights into how an AI behaves when you forbid it something.Claude, the Crafty Escape ArtistDuring development I noticed that, locally, Claude is a crafty…