The Brain Left the Box. The Vault Is Next.

Katelyn Lesse runs platform engineering at Anthropic.

When she publishes a plain-language note titled Secure agents: architecture and sandboxing [1], it reads like more than a blog post — it reads like the shape of where the platform is going, from the person building it. That is exactly how Luminity treats it: not as a personal aside, but as the earliest public form of an architecture that Anthropic’s own documentation will catch up to.

The Claim: Split the Brain From the Hands

Lesse’s architecture is a clean one. An agent has a harness (the loop, tool routing, session state) and a sandbox (where generated code and shell commands actually run). Her recommendation: “split the brain from the hands” [1] — Anthropic’s own language for this split, not a phrase unique to her post. Keep the harness, session state, and credentials outside the sandbox on trusted infrastructure; let the sandbox hold only untrusted execution. When code inside needs to reach an external service, the request routes through an egress proxy that injects the real credential at the edge — the sandbox never holds it. The same pattern extends to MCP tool access: a vault-like service sits next to the harness, and a proxy injects OAuth tokens only when the agent calls those tools. Four isolation tiers are ranked by strength — containers, gVisor, microVMs (Firecracker), full VMs — with microVMs as the practical sweet spot. It closes on a fleet-wide kill switch: something an operator can hit mid-session that stops everything, instantly, across the fleet.

What Anthropic’s Own Record Already Confirms

Three first-party technical sources back most of this today, across two different Anthropic product surfaces built on the same security logic. Anthropic’s engineering blog, in a dated account of a real production incident, describes pulling the harness and agent loop outside the execution boundary and hardening egress as the control point that actually mattered when an attacker tried to exfiltrate data through an allowlisted domain [2]. Anthropic’s live Agent SDK security documentation goes further: it names the proxy pattern as the recommended approach for credential handling — the agent sends requests without credentials, a proxy outside its boundary adds them — and it lays out the same isolation ladder Lesse describes, naming gVisor and Firecracker microVMs explicitly, with vsock-routed traffic for VM-isolated agents [3]. Both of those describe Claude’s cloud-hosted Managed Agents — the surface Lesse’s post and diagram are actually about.

A third source, older and adjacent rather than on-point, corroborates the same underlying discipline from a different surface entirely. Scanning Anthropic’s public GitHub alongside its blog and docs surfaces an October 2025 engineering post on the sandboxing behind Claude Code — the local developer tool, isolated at the OS level through bubblewrap on Linux and Seatbelt on macOS, not gVisor or microVMs — plus the public repository that implements it, anthropics/sandbox-runtime [4]. Both describe the identical credential-boundary logic: secrets held outside the sandbox, injected by a proxy at request time, never handed to the code executing inside it. That is a different product on a different isolation mechanism, and it is not evidence for the isolation-tier ranking, the named credential vault, or the fleet-wide kill switch — all three remain scoped to Managed Agents alone. But it is a third, independent instance of Anthropic engineering the same proxy-injected-credential pattern into a security boundary, which is the load-bearing claim underneath Lesse’s harness/sandbox split. The security-boundary split and the proxy-injection pattern are not just Lesse’s framing, and not confined to one product. They’re Anthropic’s documented architecture today, confirmed three times, independently, across two surfaces.

The Two Items Still Ahead of the Documentation

One specific piece of her post still isn’t in the documentation. The isolation-tier verdict: Anthropic’s own docs currently present gVisor and VM-based isolation as roughly equivalent, trading off against performance and complexity, rather than crowning microVMs outright.

The other two are further along than “not yet documented” — the code is already shipped. Reading the sandbox-runtime source directly, at commit ddbeb74 [5], turns up a session-scoped credential broker: environment variables and files are masked with a sentinel value inside the sandbox, substituted for the real credential only at the egress proxy, gated per credential to the hosts it’s allowed to reach, and re-signed rather than passed through raw for AWS SigV4 requests. None of that is in the README beyond a passing mention of “credential masks.” The same source ships a live per-session policy channel (--control-fd) that can push network allow/deny changes mid-run, plus an abort signal that tears the session down — the per-session kill switch already exists in code, undocumented. What isn’t in evidence at any tier, docs or code, is the centralized, cross-session version of either: a vault spanning sessions, or a fleet-wide broadcast of that same stop. Read against Anthropic’s own shipping cadence, the session-scoped controls read as already built; the fleet-wide layer reads as what’s next.

Why This Is the Signal, Not a Caveat

This is the same read Luminity applies to Anthropic’s product leadership generally: what a senior builder describes in public, in this much operational detail, is the preview — the documentation is what lags, not what corrects. Lesse is standing on authoritative ground for the same reason her confirmed material checks out: she is describing the architecture she is building, and the parts not yet formalized are simply the parts the writers haven’t gotten to. The discipline here isn’t in doubting her. It’s in being precise about which claims an architect can already cite as Anthropic’s documented position, and which are the credible preview of what’s coming — because those two categories inform a deployment decision differently, even when both turn out to be right.

The Enterprise Obligation Either Way

The vault and the kill switch are correct architecture regardless of when Anthropic’s documentation formalizes them. Any enterprise running agentic systems on a managed harness — Anthropic’s or anyone else’s — should build both itself now: a credential vault sitting in front of its own MCP proxy, and its own fleet-level interrupt, engineered as an enterprise control rather than awaited as a vendor feature. Being early to a pattern the vendor is clearly headed toward is not a reason to wait for the changelog entry.