"Safe" hides three questions. What can Claude Code do on your machine? What does it send to Anthropic? And does the tool itself have bugs? Anthropic's Security page answers the first, its Data usage page the second, and its advisory list on GitHub the third.
What Claude Code protects by default
In manual mode Claude Code starts read-only. It runs a short list of read commands such as ls and git status, and asks before it edits a file, runs a test or calls a network tool. curl and wget are not auto-approved by default. Unmatched commands require approval, and a command it cannot fully analyze prompts even when part of it matches an allow rule.
Two defaults deserve a second look. Auto mode is the starting mode for interactive terminal and VS Code sessions, and there a classifier model reviews actions instead of you. And the working directory boundary is a prompt, not a wall.
The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can.Claude Code docs, Security
Credentials are stored with care: in the macOS Keychain when it is available, and in a file only your user can read on Linux. That protects the key from other users. It does not protect it from a command running as you.
What leaves your machine
Claude Code runs locally and sends your prompts and the model's outputs to the API over TLS. That includes whatever it read to answer you: files, command output, error messages. Under commercial terms Anthropic does not train on that code or those prompts; on Free, Pro and Max plans, training is a setting you choose. Retention is 30 days for commercial accounts and for consumers who turn training off, five years for those who turn it on. The client keeps session transcripts in plain text under ~/.claude/projects/ for 30 days by default.
A sandbox does not change any of this. Anthropic's page on sandbox environments says so plainly: the files Claude reads are sent to the model provider "with or without a sandbox."
The tool has bugs, and they get published
Claude Code is software, so it has flaws, and Anthropic posts them as GitHub security advisories. Two from this month show the shape. GHSA-5j29-h97v-84ch, published 5 October, found that Claude Code checked a path was inside the project when it asked permission, then resolved it again at write time without checking. A symlink swapped in between could send a write outside the project. Version 2.1.129 fixed it.
GHSA-4p2j-qj3c-6x84, published 13 October, covers Claude Desktop on Windows: a git.exe committed to a repository could run when you opened that folder. Desktop 1.8089.0 fixed it. Neither needed a clever model. Both needed a file someone else put in your workspace.
The practical rule is boring and it works: keep auto-update on, and read the advisories when you pin a version.
Where the risk actually sits
Most bad days with an agent start with text it read and followed: a README that said to curl a script, an issue comment, a dependency's install step. Our list of AI agent security risks covers the wrong file, the wrong host and the prompt that does not hold. Prompts help you catch those, until you click yes without reading, which is how people end up asking whether dangerously skip permissions is safe.
MCP servers widen the surface. Anthropic reviews the connectors it lists, but its Security page is clear that it does not audit or manage the MCP servers you connect. A server you add runs with whatever access you give it.
"Claude Code cannot touch anything outside my project."
Revision 1: its file tools ask first. A shell command you approve can reach anything you can.How to run it more safely
Keep the questions you will read. Pick a mode per task and write deny rules for your secrets. Our notes on how Claude Code permissions work cover what those rules match and what they miss.
Put a wall under shell commands. The sandboxed Bash tool limits files and hosts for every command and its children. Its default still reads most of the machine, including ~/.ssh and ~/.aws/credentials, so add denyRead or credential rules before you rely on it.
Wrap the whole process for unattended or untrusted work. The Bash sandbox leaves file tools, hooks and MCP servers on the host. For those, Anthropic points to its sandbox runtime, a dev container, a container or a virtual machine, and for an untrusted repository, a dedicated virtual machine or a cloud session.
Set it once for the team. Managed settings can deliver sandbox and permission rules that developers cannot widen. Whatever you choose, it comes down to the same short list that agentic AI security means to us: directories, hosts, keys, and a person who approves more.
A side note on how we do it
We build Fenzi, which starts Claude Code inside an OpenShell sandbox with a copy of the project, a short host list and a placeholder instead of the real key; the security model sheet says what each layer stops. It is one way to build the room, and a container, a virtual machine or Anthropic's sandbox runtime can build it too.
So, is Claude Code safe?
The tool is built with care, its flaws get fixed in public, and its prompts are a real check while you still read them. What it cannot do is limit a process that runs with your account, your files and your network. Decide the room first: what it reads, where it sends, what it holds. Then choose how many questions you want. Anthropic's sandbox environments page is the best place to start.