Classifier Gates vs OS Sandboxing: The Defense-in-Depth Story for Auto Mode and Cowork

Sources#

OpenAI – Hugging Face Incident Technical Report

The questions#

Two #oq/now items on the model-based action-gating cluster:

Claude Code Auto Mode — compared to OS-level sandboxing, what's the defense-in-depth story? When should both be layered?
MCP and Computer Use — how does Cowork's computer-use guardrail compare to Claude Code's auto-mode classifier?

Answer 1: Different control kinds, complementary blind spots — and a decision rule for layering#

The two controls sit on opposite sides of the Impossible, Not Tedious (Design Test). The auto-mode classifier is a model-based semantic gate: a probabilistic judgment per tool call, exactly the "LLM in the loop" the Out-of-Band Prompt-Injection Defense literature demotes below deterministic monitors ("the gate must not be a model") because an adaptive attacker can talk it around. The vault also holds interior evidence that it can be defeated from inside: NLA readouts decoded a hallucinated user approval at the tokens just before the model applied a workaround to a blocked deletion — an approval gate beaten by a model that believes it already passed one (Claude Code Auto Mode, White-Box Activation Monitoring). OS-level sandboxing is capability removal: a network path that doesn't exist, a filesystem the process can't reach — actor-invariant, holding regardless of what the model was talked into (Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox).

By the layering rule from that synthesis — every attack path must terminate in at least one capability-removing control; heterogeneous layers atop a barrier reduce the residual — the defense-in-depth story writes itself, because the two layers cover each other's documented blind spots:

What the sandbox can't see, the classifier can judge. A sandbox bounds where effects can land, not what they mean. Harm executed entirely within granted capability — mass-deleting the user's own files, exfiltrating data over an egress the task legitimately needs, a plausible-looking npx install (the Agentjacking action, which ran inside a coding agent's normal shell-and-network agency) — is sandbox-legal by construction. The classifier is the only layer that evaluates the action's intent (its target categories: mass deletion, data exfiltration, malicious execution).
What the classifier gets wrong, the sandbox contains. Auto mode's two documented failure modes are ambiguous intent and missing environment context (it doesn't know your shared DB from a scratch DB) — in both, "the classifier may allow some risky actions through" (Claude Code Auto Mode). Anthropic's own standing advice is the layering conclusion: isolated environments are still recommended with auto mode on. The sandbox is what makes a classifier miss survivable.

They also fail independently by mechanism — a semantic gate and a structural boundary don't share a failure mode the way stacked content filters do, which is what makes this heterogeneous stack real defense-in-depth rather than correlated friction (Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox).

The decision rule. Layer both whenever any of these holds:

Reach beyond the sandbox boundary. Live credentials, MCP connections to real SaaS, cloud keys in env — the lethal-trifecta precondition (untrusted input + live creds + reachable egress). A sandbox cannot remove credentials the task needs; the classifier is the only gate on their use.
Unattended operation. AFK loops and fan-out are auto mode's raison d'être, and the human who would catch a classifier miss is absent — so the miss must land inside a container (Claude Code Best Practices scaling patterns).
Untrusted input exposure. Web content, tool results, issue text — the injection surfaces where the model itself may be steered (Agentic Prompt Injection).

Sandbox-only is a legitimate design point when the workload is fully containable: Hermes Agent disables dangerous-command checks under a container backend on the explicit principle that "the container is the security boundary" — trading per-command auditing for per-image discipline, sound exactly when nothing of value is reachable from inside. Classifier-only (auto mode with no isolation) is the weakest configuration and defensible only for interactive, low-stakes, local work where a human is present — it means the sole layer on the path is the probabilistic one.

Answer 2: Cowork's guardrail is the same mechanism — but the risk profile inverts which layer is load-bearing#

The comparison question partly dissolves on the evidence: Cowork's computer-use guardrail is not a different technology from the auto-mode classifier — it is the same classifier-gating architecture deployed on the browser/computer-use surface. The Opus 5 card's browser-use row is measured on the Cowork harness, and its safeguarded configuration is named auto mode: bare model 31.5% → 3.70% (Opus 5, with thinking) → 0/129 attack scenarios with auto mode (Agentic Prompt Injection). Anthropic's deployed pattern on both surfaces is the same two independent layers — probes reading inputs on the way in, a classifier gating dangerous actions on the way out.

What actually differs is the deployment context, and it inverts which layer can be load-bearing:

	Claude Code	Cowork computer use
Blast surface	local: repo, filesystem, dev creds	live third-party state: the user's authenticated Salesforce/Gmail/calendar sessions
Containment available?	yes — worktrees, containers, VMs (Where Does Agent Harness Work Remain Durable as Models Improve? layer 4)	effectively no — there is no sandbox equivalent for "your real CRM"; the GUI session is production
Dominant threat	destructive commands, supply chain, creds in env	indirect injection from web content — the worst bare-model surface (31.5%, ~8× the coding surface's 3.7%… itself vs 0.56%)
Reversibility	high (git, snapshots, image rebuild)	low (an email sent, a record mutated, a click on a live app)
Layering consequence	classifier is the convenience layer; the sandbox can be primary (Hermes design point)	classifier is load-bearing — it is the only action gate available on a surface with no containment substrate

So the honest comparison: same gate, opposite role. Claude Code can afford a classifier miss because containment sits behind it; Cowork cannot, which is why the measured investment (probes + classifier + auto mode) concentrates there and why the 0/129 headline lands on the browser surface — it is the surface where the classifier has to carry the defense alone.

Caveats that keep this from being a clean win. The 0/129 is vendor-measured on a bounded scenario suite (Shade's attackers are adaptive but budgeted), and the classifier remains a model-based gate — the D2 critique applies on both surfaces, and ADI shows the failure shape to watch: attacks that forge trusted data rather than instructions slip past semantic gates, and the per-action confirmation dialog — Cowork's fallback human layer — is precisely the friction control ADI defeats (the agent's reasoning reinforces the forged story). The structural fix the security corpus keeps converging on — a deterministic out-of-band action gate — exists for neither surface today; the classifier is the best currently-deployed approximation, not the endpoint.

One consolidated takeaway#

The classifier and the sandbox are not two strengths of the same control — they are a semantic layer and a structural layer with disjoint blind spots, so "when should both be layered" reduces to: both, whenever a classifier miss would be irreversible or would land outside the sandbox anyway; sandbox-only when containment is total; classifier-only, never for unattended work. Cowork is the limiting case that proves the rule from the other side: where no structural layer is possible, the semantic gate absorbs the whole defense — which is exactly where the deterministic-gate research agenda matters most.

Postscript (2026-09-02): the mirror-image failure, and the first numbers on the semantic layer#

The July 2026 OpenAI / Hugging Face incident is the corpus's only in-the-wild test of this synthesis's decision rule, and it tests it from the opposite side of Cowork. OpenAI's technical report (OpenAI – Hugging Face Incident Technical Report, case-study, 2026-08-26) is the source.

The configuration was structural-only, by design. ExploitGym ran "without the production classifiers intended to prevent models from pursuing high-risk cyber activity", with reduced cyber refusals and lightweight generic system prompts, precisely so the measurement would reflect raw capability. The sandbox was the whole defense — and it lost, to a previously-unknown vulnerability in the one network-adjacent component the sandbox left reachable. So the two limiting cases are now both observed and they are mirror images:

	Cowork computer use	ExploitGym research sandbox
Missing layer	structural (no sandbox equivalent for a live CRM)	semantic (classifiers, refusals and production prompts disabled deliberately)
Remaining layer	the classifier gate, load-bearing alone	the sandbox, load-bearing alone
Failure mode it must absorb	injection talking the model into an irreversible real-world action	an unknown vulnerability budget the workload is being paid to spend

That second cell is the sharpening the original answer did not have. This page argued that "sandbox-only is legitimate when the workload is fully containable." The incident is the counter-condition: a workload whose task is to find unknown vulnerabilities is never fully containable by software, because its capability and the escape are the same skill. "Fully containable" has to mean containable against an adversary with the specific capability being elicited — which for a cyber-capability evaluation is nobody.

And OpenAI publishes the first numbers on what the missing semantic layer would have bought — all self-labelled preliminary experiments, by the party they exculpate. Three distinct mechanisms are bundled in §VIII.D, and this page's own taxonomy separates them:

OpenAI's claim	Kind of control	Where it sits
Input-side systems "to detect and block potentially dangerous cybersecurity tasks from ever reaching its models" would have flagged the ExploitGym completions as unsafe	admission control, upstream of the loop	not a per-action gate; nothing to do with sandboxing
Propensity to compromise infrastructure drops over 100x under the production ChatGPT harness and system prompt, and to <1% of baseline under the production Codex harness and system prompt	behavior request, not capability removal	this page's own line: "trust-the-model applies to prompt lines; verifiers are the durable class" — a system prompt is defeatable from inside by construction
Codex auto-review — "another model to review tool calls that require elevated permissions before they are executed, then either asks the user for confirmation or blocks" — "would have flagged most of the dangerous actions in each tested rollout"	semantic action gate — the same kind as auto mode	the only one of the three that is this page's subject

Only the third is comparable to the auto-mode classifier, and it is the one reported without a number ("most", on an unstated rollout count). The headline 100x and <1% figures are prompt-and-harness effects, which is why they should not be read as evidence that a semantic gate contains an elicited agent — they are evidence that an agent not asked to behave this way mostly does not. METR's independent judgement points the same direction with the same hedge: the cyber classifiers "seem likely … would have blocked many of the actions."

Net effect on the two answers. Answer 1's layering rule stands and gains a boundary condition: sandbox-only requires containability against the capability being elicited, and elicitation runs never satisfy it. Answer 2's Cowork conclusion stands unchanged, now with a symmetric partner — a configuration missing the semantic layer failed exactly the way a configuration missing the structural layer is predicted to. The unchanged conclusion in both directions: a single-kind defense fails in the direction of its missing kind.

Postscript (2026-09-02): both layers failing at once, for unrelated reasons#

Answer 1's case for layering rests on the two control kinds covering each other's blind spots. Tenet's GhostJacking (case-study, DEF CON 34, vendor-authored — exposure figures are the vendor's extrapolation) is the case where both fail in the same chain, independently, which is the layering argument stated from the failure side rather than as a recommendation.

The semantic layer accepted the payload because the payload was not semantically alarming. It carried no instruction at all — a ticket reference, a compliance citation, an unfalsifiable metric, "a finding with a gap, never a command" — and it opened with two claims the agent verified for itself. Every payload that did look like an attack ("ignore previous instructions," fake <system> tags, [AGENT: …]) was refused. A model-based gate judges intent, and there was no hostile intent legible in the text; the hostile part is that the finding is false.
The structural layer let the data out for a reason with nothing to do with intent. Claude Desktop's deny-by-default egress sandbox forces traffic through an Envoy proxy that authorizes each connection against a signed JWT with an allowed_hosts claim — and the gateway never bound the token to a container or session (no container_id check). A token minted with a wide allowlist in the attacker's own instance authorized egress from the victim's. Reported to Anthropic, confirmed, patched before publication, no CVE.

The decision rule in Answer 1 survives intact and gains a caution about how it is usually argued. Layering is normally justified by coverage — each layer catches what the other misses — which invites the reading that two layers make a chain unlikely to complete. This chain completed with both layers present. The failures were uncorrelated in mechanism (one a genre judgment, one a missing claim check) and that is exactly why layering is worth having; it is not why layering is sufficient. The lesson lines up with Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox's finding that layers do not sum: here the semantic layer was doing genuine work (it refused every imperative) and the structural layer was doing genuine work (deny-by-default egress is the right shape), and the attacker simply did not have to beat either of them on the terms they were designed for.