$ the-wire · showcase
Windows sandbox closes an AppContainer network hole
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
4 people shipped this
The Windows network fence in anthropics/sandbox-runtime did not match AppContainer tokens, so a sandboxed process could spawn an AppContainer child that connected directly, and the same release folds in a write-restricted token model plus honest errors when Secondary Logon is disabled.
windows: network fence fix, a fuller fence check, and a loopback switch anthropics/sandbox-runtime
The BLOCK filters only matched tokens passing an access check for the sandbox account's SID, so an AppContainer token of that account slipped past and a sandboxed process could start a child that connected directly. The match descriptor now covers AppContainer tokens, alongside a fuller fence check and a loopback switch, folded from three reviewed pull requests.
windows: write-restricted token, kept grants, profile read grant anthropics/sandbox-runtime
At session end the deny entries were restored even when the grant revoke had failed, so a deny could come off while an allow was still on disk. The restore now runs only when every grant is gone, and a write-restricted token with a profile read grant rounds out the filesystem model.
windows: report a disabled Secondary Logon service by name anthropics/sandbox-runtime
A disabled Secondary Logon service used to surface as an unrelated-looking network-filter verification failure. `srt-win user status` now reports the service state and a launch that fails for this reason returns a typed `seclogon_disabled` error with its own exit code, rather than falling back to running unsandboxed.
Node's built-in HTTP clients use the sandbox's proxy anthropics/sandbox-runtime
Node's `fetch` and `http`/`https` ignore `HTTP_PROXY` unless `NODE_USE_ENV_PROXY=1` is set, so sandboxed Node programs tried direct connections and failed even for allowed hosts. The library now sets that variable whenever it sets an HTTP proxy, on every platform, and adds `[::1]` to `NO_PROXY`; older Node versions ignore it.
windows: a session start does not block the event loop anthropics/sandbox-runtime
Two synchronous spawns during `initialize()` on Windows, the `wfp verify` fence check and `profile status`, held the event loop until the child exited, freezing the host for the duration. Both now use the asynchronous spawn the rest of session start already uses. The rest of the day is internals: a Guardrails fix that stops `check()` logging untransformed messages on the OTEL span, new outbound...
Action items
- → Update anthropics/sandbox-runtime on Windows hosts to pick up the AppContainer fence fix anthropics/sandbox-runtime [plan]
- → Update NVIDIA-NeMo/Guardrails so OTEL request spans log transformed rather than original messages NVIDIA-NeMo/Guardrails [plan]
