Classifier Gates vs OS Sandboxing: The Defense-in-Depth Story for Auto Mode and Cowork

The questions#

Two #oq/now items on the model-based action-gating cluster:

1. Claude Code Auto Mode — compared to OS-level sandboxing, what's the defense-in-depth story? When should both be layered?
2. MCP and Computer Use — how does Cowork's computer-use guardrail compare to Claude Code's auto-mode classifier?

Answer 1: Different control kinds, complementary blind spots — and a decision rule for layering#

The two controls sit on opposite sides of the Impossible, Not Tedious (Design Test). The auto-mode classifier is a model-based semantic gate: a probabilistic judgment per tool call, exactly the "LLM in the loop" the Out-of-Band Prompt-Injection Defense literature demotes below deterministic monitors ("the gate must not be a model") because an adaptive attacker can talk it around. The vault also holds interior evidence that it can be defeated from inside: NLA readouts decoded a hallucinated user approval at the tokens just before the model applied a workaround to a blocked deletion — an approval gate beaten by a model that believes it already passed one (Claude Code Auto Mode, White-Box Activation Monitoring). OS-level sandboxing is capability removal: a network path that doesn't exist, a filesystem the process can't reach — actor-invariant, holding regardless of what the model was talked into (Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox).

By the layering rule from that synthesis — every attack path must terminate in at least one capability-removing control; heterogeneous layers atop a barrier reduce the residual — the defense-in-depth story writes itself, because the two layers cover each other's documented blind spots:

• What the sandbox can't see, the classifier can judge. A sandbox bounds where effects can land, not what they mean. Harm executed entirely within granted capability — mass-deleting the user's own files, exfiltrating data over an egress the task legitimately needs, a plausible-looking npx install (the Agentjacking action, which ran inside a coding agent's normal shell-and-network agency) — is sandbox-legal by construction. The classifier is the only layer that evaluates the action's intent (its target categories: mass deletion, data exfiltration, malicious execution).
• What the classifier gets wrong, the sandbox contains. Auto mode's two documented failure modes are ambiguous intent and missing environment context (it doesn't know your shared DB from a scratch DB) — in both, "the classifier may allow some risky actions through" (Claude Code Auto Mode). Anthropic's own standing advice is the layering conclusion: isolated environments are still recommended with auto mode on. The sandbox is what makes a classifier miss survivable.

They also fail independently by mechanism — a semantic gate and a structural boundary don't share a failure mode the way stacked content filters do, which is what makes this heterogeneous stack real defense-in-depth rather than correlated friction (Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox).

The decision rule. Layer both whenever any of these holds:

1. Reach beyond the sandbox boundary. Live credentials, MCP connections to real SaaS, cloud keys in env — the lethal-trifecta precondition (untrusted input + live creds + reachable egress). A sandbox cannot remove credentials the task needs; the classifier is the only gate on their use.
2. Unattended operation. AFK loops and fan-out are auto mode's raison d'être, and the human who would catch a classifier miss is absent — so the miss must land inside a container (Claude Code Best Practices scaling patterns).
3. Untrusted input exposure. Web content, tool results, issue text — the injection surfaces where the model itself may be steered (Agentic Prompt Injection).

Sandbox-only is a legitimate design point when the workload is fully containable: Hermes Agent disables dangerous-command checks under a container backend on the explicit principle that "the container is the security boundary" — trading per-command auditing for per-image discipline, sound exactly when nothing of value is reachable from inside. Classifier-only (auto mode with no isolation) is the weakest configuration and defensible only for interactive, low-stakes, local work where a human is present — it means the sole layer on the path is the probabilistic one.

Answer 2: Cowork's guardrail is the same mechanism — but the risk profile inverts which layer is load-bearing#

The comparison question partly dissolves on the evidence: Cowork's computer-use guardrail is not a different technology from the auto-mode classifier — it is the same classifier-gating architecture deployed on the browser/computer-use surface. The Opus 5 card's browser-use row is measured on the Cowork harness, and its safeguarded configuration is named auto mode: bare model 31.5% → 3.70% (Opus 5, with thinking) → 0/129 attack scenarios with auto mode (Agentic Prompt Injection). Anthropic's deployed pattern on both surfaces is the same two independent layers — probes reading inputs on the way in, a classifier gating dangerous actions on the way out.

What actually differs is the deployment context, and it inverts which layer can be load-bearing:

	Claude Code	Cowork computer use
Blast surface	local: repo, filesystem, dev creds	live third-party state: the user's authenticated Salesforce/Gmail/calendar sessions
Containment available?	yes — worktrees, containers, VMs (Where Does Agent Harness Work Remain Durable as Models Improve? layer 4)	effectively no — there is no sandbox equivalent for "your real CRM"; the GUI session is production
Dominant threat	destructive commands, supply chain, creds in env	indirect injection from web content — the worst bare-model surface (31.5%, ~8× the coding surface's 3.7%… itself vs 0.56%)
Reversibility	high (git, snapshots, image rebuild)	low (an email sent, a record mutated, a click on a live app)
Layering consequence	classifier is the convenience layer; the sandbox can be primary (Hermes design point)	classifier is load-bearing — it is the only action gate available on a surface with no containment substrate

So the honest comparison: same gate, opposite role. Claude Code can afford a classifier miss because containment sits behind it; Cowork cannot, which is why the measured investment (probes + classifier + auto mode) concentrates there and why the 0/129 headline lands on the browser surface — it is the surface where the classifier has to carry the defense alone.

Caveats that keep this from being a clean win. The 0/129 is vendor-measured on a bounded scenario suite (Shade's attackers are adaptive but budgeted), and the classifier remains a model-based gate — the D2 critique applies on both surfaces, and ADI shows the failure shape to watch: attacks that forge trusted data rather than instructions slip past semantic gates, and the per-action confirmation dialog — Cowork's fallback human layer — is precisely the friction control ADI defeats (the agent's reasoning reinforces the forged story). The structural fix the security corpus keeps converging on — a deterministic out-of-band action gate — exists for neither surface today; the classifier is the best currently-deployed approximation, not the endpoint.

One consolidated takeaway#

The classifier and the sandbox are not two strengths of the same control — they are a semantic layer and a structural layer with disjoint blind spots, so "when should both be layered" reduces to: both, whenever a classifier miss would be irreversible or would land outside the sandbox anyway; sandbox-only when containment is total; classifier-only, never for unattended work. Cowork is the limiting case that proves the rule from the other side: where no structural layer is possible, the semantic gate absorbs the whole defense — which is exactly where the deterministic-gate research agenda matters most.