Most people’s understanding of Claude Code security comes down to one sentence: just turn on /sandbox.
I thought so too at first. Then I listed what actually needs to be isolated, and it turned out to be less simple. Bash commands, Read/Edit/Write, MCP Servers, Hooks, and plugin Monitors all run inside one session, but they don’t all live on the same layer.
/sandbox is great, but it mainly covers commands and their child processes.
The built-in file tools still run inside the Claude Code process. MCP Servers, command Hooks, and plugin Monitors may also be separate processes running directly on your host. In other words, getting Claude to ask for “Allow” fewer times and locking it in a truly separate room are two completely different things.
