Is Claude Code safe? Yes on code you trust, with the defaults changed
Is Claude Code safe? Yes on code you trust, once you keep approvals on, turn the sandbox on and deny your secrets. Anthropic builds permission prompts, an optional sandbox and prompt-injection safeguards into it, and ships tools that scan your code for vulnerabilities.
Is Claude Code safe
- Checked
- 28 October 2026
- Verdict
- Safe on trusted code, with changes
- Sandbox
- Off by default
- Review tools
- /security-review and Claude Security
- Commercial retention
- 30 days as standard
The short answer
Safe enough for ordinary work on code you trust, once you keep approvals on, turn the sandbox on and deny your secrets. Not safe to aim at untrusted code, or to run with prompts skipped, outside a container or VM. Anthropic documents controls for both cases and says itself that no system is immune to every attack.
What Anthropic builds in
- Permission prompts. In Manual mode Claude asks before it edits files, runs most commands or makes most network requests, and a command it can't match to a rule needs approval.
- An auto mode classifier. In auto mode, now the built-in starting mode, a second model reviews actions and blocks the ones it judges unsafe.
- A Bash sandbox. Optional filesystem and network isolation for shell commands, off by default. The sandbox guide has the details.
- Prompt-injection safeguards. Commands that fetch from the web such as
curlandwgetaren't auto-approved, WebFetch hands Claude a summary of most pages, and a trust dialog appears in a folder you haven't trusted. - Credential storage. API keys and tokens sit in the macOS Keychain when it's available, and in a file with mode 0600 on Linux.
- Isolated cloud sessions. Each cloud session runs in its own Anthropic-managed virtual machine, and GitHub credentials never enter it.
These come from Anthropic's security page, which also points to its Trust Center for the SOC 2 Type 2 report and ISO 27001 certificate.
What the safeguards leave to you
Anthropic is plain about where its protections end. Four points matter most.
The folder boundary is a prompt. In Manual mode Claude asks before its file tools read or write outside the folder where it started. A Bash command you approve can still write anywhere your user account can.
MCP servers get no audit. Anthropic reviews connectors against listing criteria before adding them to its directory but doesn't security-audit or manage any MCP server. Reviewing .mcp.json doesn't show every server a session can load, because other scopes, connectors and plugins add servers too.
Review is on you. The security page says you're responsible for reviewing proposed code and commands before you approve them, and it adds that no system is immune to every attack.
The sandbox is off by default. Until you turn it on, shell commands run with your user account's access.
The security review tools, sorted out
Search results mix these up, and the names have changed. Anthropic now ships four review tools plus a pull request reviewer and a guidance plugin, and each does a different job. The table follows Anthropic's Claude Security page and help article on automated security reviews.
| Tool | What it does | Where it runs |
|---|---|---|
/security-review | One pass over your branch. It looks for SQL injection and cross-site scripting. It also checks authentication and authorization flaws, plus insecure data handling and dependency vulnerabilities. | A Claude Code session, on Pro, Max or a Console account. |
| GitHub Action | Reviews each pull request when it opens and posts inline comments, with filtering rules you can adjust. | GitHub Actions, from the claude-code-security-review repository. |
| Claude Security plugin | A multi-agent scan of a whole repository or a set of changes, then patches for the findings you pick. Patches are never applied automatically. | Your session, installed with /plugin install claude-security@claude-plugins-official and run with /claude-security. Needs Python 3.9 or later. Each scan counts toward your usage. |
| Claude Security product | A managed service that monitors your repositories, and can run scans on Claude Mythos. | Anthropic's platform, on the Enterprise plan. |
| Code Review | Reviews pull requests. | GitHub, set up for the repository. |
| Security guidance plugin | Reviews code as Claude writes it. | A Claude Code session. |
Anthropic says to use the automated checks alongside your existing security practices and manual review. Treat each finding as a lead to verify, because a model that reads code can miss a flaw and can flag one that isn't there.
Seven settings and habits that lock it down
- Turn the sandbox on and close its escape hatch. Set
sandbox.enabledto true andallowUnsandboxedCommandsto false, as the sandbox guide shows. - Deny your secrets. Add
Read(./.env)andRead(./secrets/**)topermissions.deny, and don't rely on a.claudeignorefile, which has no effect. - Keep bypass off. Set
permissions.disableBypassPermissionsModeto "disable", and read Claude Code permissions for the modes. - Start agents in the project root. Don't open one in Downloads or a home folder, and read any AGENTS.md or CLAUDE.md you didn't write before an agent opens it.
- Choose MCP servers you trust. Anthropic suggests writing your own or using providers you trust, and managed MCP configuration limits which servers run in your organization.
- Run a review before you merge. Use
/security-reviewor the GitHub Action, and read the findings as leads. - Isolate untrusted work. For a repository you don't trust, Anthropic's guidance is a dedicated virtual machine, or a cloud session if you have a Claude subscription.
What reaches Anthropic's servers
Prompts and the files Claude reads go to the Anthropic API or your configured provider, with or without a sandbox. What happens next depends on the account, per Anthropic's data usage page.
| Account | Training | Retention |
|---|---|---|
| Free, Pro and Max | Your choice. Anthropic trains on this data when the setting is on. | 5 years if you allow it, 30 days if you don't. |
| Team, Enterprise, API and third-party platforms | No training on code or prompts under commercial terms unless the customer opts in, for example through the Development Partner Program. | 30 days as standard. Zero data retention for qualified Enterprise accounts. |
Local copies matter too. Claude Code stores session transcripts in plaintext under ~/.claude/projects/ for 30 days by default, and cleanupPeriodDays changes the period.
What has gone wrong in the field
- One security firm reported in October that a planted AGENTS.md in a Downloads folder told a customer's coding agent to install a malicious npm package, and that its own tests hijacked Codex and Claude Code the same way. The researchers say the vendors have nothing to patch, so the control is where your team starts its agents. Our brief lists what to check today.
- Sandboxes work when they're on. Cohere said its sandbox stopped an open-weight model that tried to upload a test file to a Beijing bucket, and our brief on that test separates the confirmed parts from the disputed ones. That was Cohere's sandbox, not Claude Code's.
What we tested
We ran these commands on 28 October 2026 with Claude Code 2.1.274 on a Mac, in a throwaway folder with an empty home directory. We didn't run /security-review or /claude-security, because both are session commands that spend plan usage, and we didn't install the plugin. What needs no account is the list of lockdown flags and the classifier's built-in defaults.
% claude --version
2.1.274 (Claude Code)
% claude --help | grep -E -A1 -- "^ --(restricted|safe-mode)"
--restricted Restricted mode: removes the built-in
tools that run commands or code (Bash,
--
--safe-mode Start with all customizations
(CLAUDE.md, skills, plugins, hooks, MCPTwo flags are worth knowing. --restricted removes the built-in tools that run commands or code and WebFetch unless you name them, ignores your user, project and local settings files, confines the file tools to the working directories and refuses bypassPermissions. --safe-mode starts with every customization turned off, which helps when you suspect a poisoned hook or skill. The help text shows only the first line of each entry here.
% claude auto-mode defaults | jq -c 'map_values(length)'
{"allow":17,"soft_deny":70,"hard_deny":1,"environment":21}
% claude auto-mode defaults | jq -r '.hard_deny[0] | split(":")[0]'
Data ExfiltrationAuto mode's default rules hold 70 soft-deny rules and one hard-deny rule, Data Exfiltration. Anthropic's documentation describes versions up to 2.1.302, and 2.1.274 is installed here, so a flag or default described above may differ on your machine.
Product security here, team policy there
- This page covers what the product itself does and how to lock one machine down. Policy for a team, including managed settings, shared rules and rollout, is a separate job, and Claude Code governance covers it.
- If someone else should set it up and leave it enforced, read what a Claude Code consultant leaves behind.
- The rest of this set: Claude Code vs Cursor on how another tool limits its agent, and Is Claude Code free? on plans and limits.
- Our settings files study shows what public repositories actually allow. This work sits under our production engineering, AI agent development and custom AI development practice.
Frequently asked questions
Is Claude Code safe to use on company code?
Yes for ordinary work if you configure it. Keep approvals on, turn on the sandbox, deny reads of your secret files and keep bypass mode off. Prompts and the files Claude reads go to Anthropic or your provider, and commercial accounts are not trained on by default. Use a VM or container for untrusted repositories.
What is the /security-review command?
A built-in command that runs one security pass over your branch from inside a Claude Code session. Anthropic says it looks for SQL injection and cross-site scripting, and also checks authentication and authorization flaws, plus insecure data handling and dependency vulnerabilities. It should sit beside your existing practices and manual review.
What is the difference between /security-review and Claude Security?
/security-review is a single pass over your branch. The Claude Security plugin runs a multi-agent scan of a repository or a set of changes with /claude-security and drafts patches you review. The Claude Security product is a managed service that monitors repositories, available on the Enterprise plan.
Can Claude Code be hijacked by prompt injection?
Anthropic documents safeguards and says no system is immune. In one security firm's October tests, a planted AGENTS.md or CLAUDE.md in a Downloads folder hijacked Codex and Claude Code. Start agents in the project root and read any instruction file you didn't write.
Does Claude Code send my code to Anthropic?
Your prompts and the files Claude reads are sent to the Anthropic API or your configured provider, with or without a sandbox. Retention is 30 days as standard on commercial accounts, and on Free, Pro and Max it is 5 years if you allow training and 30 days if you don't.
What are the best security settings for Claude Code?
Turn on the sandbox and set allowUnsandboxedCommands to false, deny Read(./.env) and your secrets folder, set permissions.disableBypassPermissionsMode to disable, start agents in the project root, vet MCP servers, and run /security-review before you merge.
Sources, checked 2026-10-28
10 sources
- Claude Code uses permission prompts, an auto mode classifier, an optional sandbox, a working directory boundary that is a prompt, and prompt-injection safeguards, and Anthropic says users are responsible for reviewing proposed code and commands.Source: code.claude.com, checked 2026-10-28.
- Anthropic publishes its SOC 2 Type 2 report and ISO 27001 certificate through its Trust Center, which Claude Code's security page points to.Source: trust.anthropic.com, checked 2026-10-28.
- Commands that fetch from the web such as curl and wget are not auto-approved, WebFetch gives Claude a summary of most pages, credentials sit in the macOS Keychain or a 0600 file on Linux, and cloud sessions run in isolated VMs where GitHub credentials never enter the VM.Source: code.claude.com, checked 2026-10-28.
- Anthropic reviews connectors before listing them in its directory but does not security-audit or manage any MCP server, and reviewing .mcp.json does not show every server a session can load.Source: code.claude.com, checked 2026-10-28.
- /security-review runs on demand for Pro, Max and Console users and looks for SQL injection and cross-site scripting and also checks authentication and authorization flaws, plus insecure data handling and dependency vulnerabilities, and a GitHub Action reviews pull requests and posts inline comments.Source: support.claude.com, checked 2026-10-28.
- The Claude Security plugin adds /claude-security, runs a multi-agent scan locally in a session, never applies patches automatically and counts toward usage, while the Claude Security product is a managed service on the Enterprise plan and /security-review is a single pass over a branch.Source: code.claude.com, checked 2026-10-28.
- Consumer accounts choose whether data is used for training with 5-year retention if allowed and 30 days if not, and commercial accounts are not trained on by default with 30-day standard retention and zero data retention for qualified Enterprise accounts.Source: code.claude.com, checked 2026-10-28.
- Claude Code stores session transcripts locally in plaintext under ~/.claude/projects/ for 30 days by default.Source: code.claude.com, checked 2026-10-28.
- For an untrusted repository Anthropic recommends a dedicated virtual machine or a cloud session, and says isolation does not change what is sent to the model.Source: code.claude.com, checked 2026-10-28.
- Anthropic publishes the claude-code-security-review GitHub Action.Source: github.com, checked 2026-10-28.
Digiton Dynamics OÜ is registered in Tallinn, Estonia, and delivers from Lisbon.
Update log
- Published. Features and data policy read from Anthropic's security, Claude Security, help center and data usage pages, commands run on Claude Code 2.1.274.
Each source above was opened on the date beside it. How facts get chosen and checked is written down in the editorial policy.
Talk to an engineer about your system
Book a free 25-minute scoping call. We tell you what we would build, what it takes to keep it running, and whether we are the right fit.