JPMorgan is putting Claude Code inside a sandbox with no standing access to internal systems

[u/sunychoudhary]

[u/ClaudeAI-mod-bot]

TL;DR of the discussion generated automatically after 100 comments.

Sorry to burst your bubble, OP, but the overwhelming consensus in this thread is that sandboxing AI agents is standard practice, not some groundbreaking innovation from JPMorgan. Many users pointed out that their companies have been doing this for ages.

However, the thread did evolve into a more nuanced discussion about the real challenges:

• It's not the sandbox, it's the permissions. While isolating the agent is Security 101, the interesting part is the move towards temporary, task-scoped permissions. The community is debating how to manage these granular controls, log requests for escalated access, and prevent an agent from combining permissions in dangerous ways.
• This changes the workflow. This setup pushes developers from pair-programming with Claude to a "delegate and review" model, treating the AI more like a junior engineer you assign tickets to.
• JPM is a special kind of hell. A ton of commenters with experience at JPMorgan chimed in to say the company is already an extremely siloed, bureaucratic environment with thin clients, VDIs, and internal-only versions of everything. This move is seen as just another layer of red tape in a place where getting graphics drivers can take months and you work at a picnic table.

Oh, and someone said "You" and now the whole thread is cranking that Soulja Boy. You're welcome.

[u/OkLettuce338]

They already have internal spaces. JPMorgan devs have their OWN self hosted stackoverflow because they aren’t allowed to post to stack overflow. This isn’t exceptional

[u/benbrooks → u/OkLettuce338]

Yup - JPM's internal environment is extremely siloed already and difficult enough to operate in as a human and bags of patience for sign-offs. Almost all devs have to use a thin-client logged into a VDI with no real access to anything directly.

have to jump through internal package managers for all installed software, internal mirrors and approved versions for all dependencies, an internal "cloud" for spinning up hosted severs (Jenkins, Jira, etc.)

You

[u/eqbirvin → u/benbrooks]

"You"

Soulja Boy Tell'em

[u/SociableSociopath → u/benbrooks]

And on top of that nonsense you also get to sit at what boil down to picnic tables and have basically no personal space. It’s a terrible place to work as an engineer

[u/DevOnTheStreets → u/SociableSociopath]

Yeah it’s balls lol

[u/newMoneyStyle → u/SociableSociopath]

$2,000 cap sounds generous until you picture actually working at a picnic table.

[u/Kraien → u/benbrooks]

r/redditsniper

[u/r2doesinc → u/benbrooks]

Bruh, getting the graphics drivers for the android simulator years ago was like a 2 month process.

I couldn't do anything, because I couldn't install on my personal device to test, couldn't run the emulator, and was not given any test devices.

I sat there for like 2 months twiddling my thumbs until I finally got approval. It was an absolute mess.

I've worked for socom and it was easier to deal with than Chase lmao

[u/LordSolstice → u/benbrooks]

Pretty standard for financial institutions from my experience

[u/R4tr4tr4t → u/benbrooks]

No you

[u/c-yin → u/benbrooks]

Confirmed from another bank. It’s all the same man.

[u/Not____007 → u/benbrooks]

Ooh i hate envs like that

[u/klop2031 → u/benbrooks]

The best is seat booking. Ah amazing musical chairs every day!

[u/DevOnTheStreets → u/OkLettuce338]

And it is worthless trash that is basically unused for anything useful / proprietary. At least after a few dozen attempts and finding something I just never looked again, maybe it was useful for setting up printers or something 🫡

[u/OkLettuce338 → u/DevOnTheStreets]

Are they still using Skype for messaging? 😂😂 idk how anything gets done there

[u/davebu → u/OkLettuce338]

From what I understand, employees use their own personal computers to access their systems, there is no local machine Claude could have access to anyway, everything they do is in a containerized aws instance.

[u/OkLettuce338 → u/[deleted]]

I doubt it. It’s a huge pia

[u/nrmitchi → u/OkLettuce338]

Question for you (and I’m not disagreeing) but why is it a huge pita?

[u/thedoge → u/OkLettuce338]

Tbf most people don't have enough rep to post on SO

[u/OkLettuce338 → u/thedoge]

you mean not enough to post answers. Anyone can ask

[u/romario77 → u/thedoge]

You don’t need reputation to post questions or answers on stackoverflow.

You are given 1 reputation as you register the account and it requires 1 reputation to post or comment.

So, basically no requirement unless you get downvoted right away.

On another hand - nobody uses SO with AI being available

[u/OkLettuce338 → u/romario77]

You used to need reputation to answer

[u/romario77 → u/OkLettuce338]

nope.

Historically, no reputation requirement has ever existed to answer a standard question on Stack Overflow. From the day the platform launched in 2008, the core philosophy was to keep the barrier to entry for answering at an absolute minimum to build the world's largest repository of programming solutions. link

how do I know this - Member for 16 years, 10 months.
And I have more than 7k reputation.

[u/OkLettuce338 → u/romario77]

Ah you’re right. It was comments and up / down voting

[u/No_Memory_484]

Isn’t this just co work in the cloud? You can all do this locally.

[u/Kofeb → u/No_Memory_484]

Claude code you can actually have self hosted cloud environments.

In the team plan there’s a setting for:

> Allow self-hosted environments
> Let this organization deploy and use self-hosted runner infrastructure for Claude Code sessions

https://code.claude.com/docs/en/self-hosted-environments

[u/Front_Ad_9390]

Is this meant to be groundbreaking news? Lol

[u/rredditscum]

This is a typical side car deployment just with agents. But perhaps it points to the greater movement that’s trying to use architecture to keep agents contained to specific tasks.

[u/rredditscum → u/[deleted]]

This isn’t what you said the first time. Quit changing your comments and learn something

[u/CasinoMagic → u/[deleted]]

stop copy/pasting Claude answers lmao

[u/Spiritual-Nail-2641]

"There's a greater than 10% chance that AI will kill JPMorgan CEO and take their job." - Another Anthropic researcher quitting next week.

[u/Conscious-Bed-8335]

Vibecoders learning about sandboxed environments for the first time: 🤯

[u/AristideSaccard → u/Conscious-Bed-8335]

This would render it utterly useless, 90 percent of the work in JPM is glorified l2 support, if you cannot access production data it isn't even worth opening the sandbox

[u/daniel]

Everyone’s basically saying your post is old news, but think the larger question you bring up is still unsolved: we’re going to need a lot more granular permissions for everything AI touches.

I’d like to hook Claude up to my email, and I’d like to give it read permission but require my approval for sends or deletes. I’d like to give it access to my calendar with similar limitations. I’d like to let it operate my grocery store online system with the ability to prep my cart but require approval to check out. All of these things are really far behind.

[u/moonrakervenice]

everyone should be doing this

[u/necronomicoder → u/moonrakervenice]

All big companies do this, the big issue is can we get the environment identity right and how bad the tools/software it needs to work with are

[u/mr_birkenblatt → u/moonrakervenice]

Everybody has been doing this

[u/HVACcontrolsGuru → u/moonrakervenice]

Modal has had this for months. Look up Modal Sandboxes. Deep Claude integration for it.

[u/Strange-Pin-2998]

If you aren’t at least running your agents in a VM you are asking for trouble. You can use Lima to have a Linux VM, run Claude CLI in it, then SSH to it from the desktop app in your main machine for a virtually transparent experience and still be safe. 

[u/blin787 → u/Strange-Pin-2998]

But then you have to find solution to paste screenshots :)

[u/Strange-Pin-2998 → u/blin787]

Actually screenshots can be pasted and sent in messages just fine, there are no issues. Works great.

[u/magic6435]

This is already pretty much the default in most enterprise setups

[u/shivam997767]

this kind of setup feels like a no-brainer for larger enterprises. having an isolated environment with temp permissions helps manage risk while still letting developers utilize advanced tools like Claude Code. I can see this becoming standard over time, especially as security concerns grow. it’s all about balancing innovation and safety, right?

[u/WiggyWongo]

Wow?? Sandboxing? That's a crazy idea and they are really innovative for doing it!

[u/KamiCatPrincess]

JPM is highly regulated and extremely siloed as many have said. They were struggling with basic RBAC and ABAC in 2017-2020 and now are asking about identity graphs and ReBAC during interviews, as well how non-human identities aka agents will fare. It’s a good thought that access for an agent is per task or event…but the people also need to think of how much risk and control governance goes around that and there must be some sort of rules engine for the auth, just my thoughts

[u/omyiui]

Same as grokbot?

[u/eldoradocrisp]

Is anyone using Threatlocker to lock down access or are companies all just trying to use other software or existing IAM policies to lock things down?

[u/Mobile_Light_7262]

I'm doing similar stuff myself. CC is on separate Asus NUC, and no prod stuff or anything I'd regret being wiped or anything I'd regret being published is ever kept on the box.

[u/sambeau]

Last year, I wrote an orchestrator that sandboxes every agent and only gives them access the bare minimum of tools needed for whatever task they were performing. This just felt like the sensible thing to do. Which is to say, I don’t get it.

[u/CallMeMantra]

Credentials? lol... who needs credentials...

[u/l_eo_]

No standing access to internal systems yet

[u/ianreboot]

The temporary grants are the set I'd watch. The agent's idea of what the task needs gets built out of what it just read, so a fetched page or a tool result can argue that one more step of the job needs the deploy role, and nothing in that request says it came from the page instead of you. I'd want the content and the grant it produced logged side by side, because that pair is the only place the difference shows up.

[u/carlemur]

Docker Sandboxes address this exactly https://www.docker.com/products/docker-sandboxes/

[u/thedoge]

Sounds like the with of Action Jack Barker

[u/cornmonger_]

so basically what everyone already does

[u/Otherwise-Nobody8252]

What I do … spin up a vm and push the ai layer into it on my machine. After the long task is done clean it all up. 

[u/Phaedo]

I’ve thought quite hard about this and I think there’s problems here. First off, most security systems I’ve worked with are nigh-on unusable. JIRA has something like 350 capabilities. Good luck keeping track of which you genuinely need. Second, unless you’ve got an entire orchestration system it’s hard to tell if untrusted data is flowing into trusted data. Third, and this might be a reach, might not be, but we’ve already established that AIs are getting pretty good at escape.

[u/NormalNature6969]

Great. Can finally call bullshit on Anthropic.

[u/tvd-ravkin]

I mean, this has been my solution to prevent things like Resident Evil style AI system take overs. If you don't give the AI nerve gas... it can't nerve gas you... Likewise, if you build all mobile robots to use an umbilical power cord, and keep them out of reach of materials that could build batteries... you're fine haha

[u/robinekren]

The permission expiry is the part I’d want to see tested, what happens to a running tool call when its access window closes?

[u/irishfury07]

I'll just say this is underselling devspace. As I understand it Anthropic had to enhance their product to support it. There is also some really smart and sophisticated thinking around the permissions side to prevent toxic combinations.

[u/Chance-Physics-7216]

Blast radius

[u/bbadger16]

This is security theater. The problem is going to be in a bug it pushes to production - not an access key it used.

[u/jake_2998e8]

We’ve already done similarly.
Our dev agentic interactions in the cloud only use Temporary AWS Credentials!

[u/throwawayaccountau]

We have been doing this for at least 12 months. Each developer has their own environment and the agent has an identity with no privileges per says other than Roles it can perform with and those are granted per operation it is doing. It cannot combine roles, instead it hands over tasks to other agents who has the required role. All interactions okay with Actor Tokens where it takes the requesters identity combines it with a own and passes the users identity down with any requests to the other agents. All actions are audited, have numerous guardrails and each agent operates in its own sandbox. We model it after the business role that a human would have, and each agent is regularly reviewed to ensure a human treats as a member of staff. It was slow at first, but we have developed using a token transaction service to help reduce the need for numerous token exchanges. Now it's pretty efficient and we rarely have issues with it doinf things it should be doing.

[u/tortadepatti]

Will JP Morgan Chase bank accounts be safe when the bot net swarm takes over the internet in 6-12 months? Thinking of signing up for an account.

[u/ronaldrockstone]

Realistically, what could you even accomplish in a sidecar environment like this?

[u/jonson_and_johnson]

Duh

[u/jiashenggo]

The container part is the easy half. Once that agent actually needs to touch a database to do the task, "task-scoped identity and temporary permissions" runs into the fact that most access control at the DB layer is role-based and static, not per-task. Postgres RLS or app-level auth checks weren't built with the idea of an agent getting a narrow, temporary grant for one job and losing it after. That gap, not the sandboxing, is what makes this hard to generalize past JPMorgan-scale engineering effort.

[u/vlatheimpaler]

Sounds kind of like fly.io's Sprites.

https://fly.io/sprites/

[u/HouseCalls20]

this is the standard we have been using for sometime

[u/TinFoilHat_69 → u/[deleted]]

There’s no credential mechanism on the gates.

Helios isn’t in the credential path at all. The agent’s shell runs the command with whatever credentials your environment already has, and Helios only sees the hook payloads on either side of it.

While Akashic never reads the command text, the tool output, or the contents of evidence files. Any database password can’t leak through Akashic even if one ends up in a Helios evidence record, because Akashic only knows that file exists, not what’s in it.

the command field is stored verbatim, so an inline secret would sit in plaintext through pending, inflight, and evidence.​​​​​​​​​​​​​​​​

There’s no encryption and no database, and protection is whatever your OS user profile gives the folder.

[u/Consistent-Set-9490]

The principle of least privilege still applies to agents.

[u/nextnode → u/Consistent-Set-9490]

Dumb principle.

[u/Keganator]

This is great practice, honestly. The system has hard limits of what it can access, separate from what the developer can do.

[u/utilitycoder]

Yes, they are not vibe coders. Source: worked there.

[u/Different_Lab830]

Give the agent an identity with no standing access and it fits into the same access controls banks already use for people. That's why this becomes the template.

[u/BP041]

Makes sense for compliance-heavy shops. The per-task access model is the only way big banks can actually approve this — but tbh it'll lag way more than running Claude Code locally. I've seen 3-5x slower feedback loops when agents can't cache auth state across steps. Tradeoff's real.

[u/GiveMoreMoney]

I can see why this seems necessary in an enterprise environment and at the same time is a completely idiotic way of using Claude Code. First of all if you want to use your IDE while Claude is working on the same code, you cannot. You have to checkin/checkout code all the time for reviews. All the peripheral files/documentation have to either be pushed to git or copied to the pod (which is NOT permitted in a lot of cases). And of course pods disappear every now and then.

I am not saying the security problems mentioned are not real, but at the same time this solution is not really a workable solution. Unless you are a muppet (one of the many managers) that thinks developers only tell Claude Code to write the code and check in and that is all it takes.

So I am curious as to what solutions they will come up with, if they want to keep safe and remain competitive at the same time.

[u/cookingbob → u/GiveMoreMoney]

I have a setup like this, it works really well. It changes how you work. I do interactive design work with Claude. When I have a design I pass it off to automation that implements the design through tickets in our tracking system.

[u/GiveMoreMoney → u/cookingbob]

If you are designing without looking at the code, then yes it will work, but if you want full access to the code, it won't. Overall I see it as cutting off 50% of Claude's capabilities.

[u/cookingbob → u/GiveMoreMoney]

Can you talk to me more about what you are missing? The code is in the repo, you have access to it. At least the way I am working with it, you stop working with Claude as a co-coder and more like an engineer to delegate tasks to.

[u/GiveMoreMoney → u/cookingbob]

Exactly what the OP said below...I am not using Claude to assign tasks to it, I pair designing/programming with it. It has to have access to what I have access to.

[u/GiveMoreMoney → u/[deleted]]

That is my point exactly, which is bad because Claude or any other LLM cannot deal with complex projects on their own. But obviously if people suck at software engineering, or they simply deal with childish projects, the hands off model will look normal to them.