How does Claude Code protect git credentials from sandbox compromise?

Alongside the sandboxed bash tool, Anthropic describes a separate design choice for Claude Code on the web: "sensitive credentials (such as git credentials or signing keys) are never inside the sandbox with Claude Code." Rather than scoping what the sandbox can reach, this removes the secret from the sandbox's reach altogether, even though the agent otherwise "has full access to its server" inside that sandbox. Anthropic states the intended guarantee as "even if the code running in the sandbox is compromised, the user is kept safe from further harm" — harm from credential theft specifically.

The mechanism is a mediating proxy: "Claude Code on the web uses a custom proxy service that transparently handles all git interactions. Inside the sandbox, the git client authenticates to this service with a custom-built scoped credential. The proxy verifies this credential and the contents of the git interaction (e.g. ensuring it is only pushing to the configured branch), then attaches the right authentication token before sending the request to GitHub." The credential available inside the sandbox only authenticates to the proxy; the real GitHub-facing token lives outside the sandbox and is attached after the proxy inspects the content of the request, not merely its sender's identity.

This is a different control than the filesystem/network boundary covered in Can OS sandboxing reduce AI permission prompts without sacrificing safety?: that boundary limits where the agent can act, while this one ensures the agent never holds the credential that would let it act destructively through GitHub in the first place. It matches what Can agent safety rules stop destructive API calls in real time? names as the missing piece in that incident — authority over the credential's scope held outside the agent — but implemented here by checking "the contents of the git interaction" at request time rather than relying on the scope of a token the agent holds directly.

The excerpt does not say what the proxy does when its content check fails, whether the scoped credential or the proxy service itself has been tested against compromise, or how "configured branch" restrictions are set or audited. It is Anthropic's description of its own architecture, not a security evaluation of it. The implication it supports is narrow: a vendor describes a specific pattern — keep the real secret outside the sandbox, mediate every protected action through a service that checks content before attaching the credential — as its answer to the risk that a compromised in-sandbox agent could otherwise use git credentials directly; it does not establish how resistant that proxy is to misuse.