Do I still need CC Safety Net if I run my agent in a sandbox or container?
Yes, if you care about uncommitted work. A sandbox like Claude Code’s or Codex’s limits writes to the project directory and restricts network access. Butgit reset --hard and rm -rf . write inside that directory, and git push --force goes to a remote you allowed, so the sandbox permits all three. CC Safety Net blocks them.
CC Safety Net does not contain processes or control the network. Against prompt injection, malicious dependencies, untrusted code, or data leaving over the network, a sandbox is the better choice. Use both.
Do I need CC Safety Net if my agent has permission deny rules?
It depends. As of October 2026, Claude Code’s deny rules are deterministic and still apply inbypassPermissions mode. If you only need to block a few exact commands in one CLI, they may be enough.
Deny rules match the command string against a wildcard pattern, so reordered flags (rm -r -f), a shell wrapper (sh -c "..."), or an interpreter can slip past. CC Safety Net parses what the command does, so it catches those variants. It also applies one policy and one audit log across 16 CLIs.
What each layer covers and misses
Each layer decides on different evidence, so each one misses cases the others catch.
Known limitations lists what CC Safety Net cannot protect, and which layer covers each case.
Why a sandbox allows destructive git commands
A sandbox restricts where a process can write, not what it does there. As of October 2026, Claude Code’s sandboxing docs scope writes to the working directory by default, sogit reset --hard and rm -rf . on your project are permitted writes.
git push --force writes nothing locally, so a local write scope does not cover it. The sandbox has no concept of Git history, uncommitted changes, or stash entries.
Whether these commands run automatically or require confirmation depends on your agent’s sandbox mode and approval policy.
~/.aws/credentials and ~/.ssh/ as files it still allows reading. CC Safety Net blocks content access to those paths with no configuration.
When sandboxing is the better choice
Use a sandbox when your main concern is one of these:- Prompt injection. Restrict outbound network domains to reduce exfiltration.
- Malicious dependencies. Limit the filesystem writes and network access of untrusted packages.
- Untrusted code. OS-level containment is stronger than command-text analysis.
- Network control. CC Safety Net has no network layer.
Permission prompts and approval classifiers
This layer asks you, or a classifier model, before an action runs. As of October 2026, Claude Code’s permission modes ask before most edits and shell commands in Manual mode. In auto mode, “a second model, the classifier, reviews actions instead of you”, and it blocks destructive git commands such asgit reset --hard and git stash clear by default.
That review is a judgment, and you can turn it off. Anthropic publishes a 17% false-negative rate for the auto-mode classifier on real overeager actions and calls it “not a drop-in replacement for careful human review”. Under bypassPermissions, everything runs without asking.
A CC Safety Net denial applies in every permission mode, including bypassPermissions. See Claude Code permission modes and bypass mode for the version it was verified against.
Containers, VMs, and checkpoints
A machine you can throw away is real containment, and Claude Code recommendsbypassPermissions for “Isolated containers and VMs only”. It does not protect the work inside the machine.
A cloud session clones your repository and pushes back to your real remote, so git reset --hard costs the same uncommitted work there, and git push --force lands on a branch your teammates pull. A local container that mounts your working tree is the same, because the mount is writable. Cloud environments covers the credential side.
Checkpoints cover part of that gap. As of October 2026, Claude Code’s checkpointing docs state that “Checkpointing does not track files modified by bash commands.” A destructive git command runs as a bash command, so a rewind does not restore the work it discards.
Use sandboxing with CC Safety Net
A sandbox limits what any command can reach, and CC Safety Net stops the destructive commands and credential reads that a sandbox allows inside that boundary. Sandboxes and allowlists also break. In 2026, CVE-2026-25725 escaped Claude Code’s bubblewrap sandbox throughsettings.json, and CVE-2026-22708 bypassed Cursor’s command allowlist. Run every layer you have.