Architecting a Secure AI Sandbox: The Ultimate Guide to Running Claude Code on a Spare Mac

The Security Risk of Agentic LLMs on Your Workstation

Agentic AI has officially arrived in the terminal. Tools like Anthropic's Claude Code are no longer just passive code generators; they are active execution engines. They write scripts, execute compilation steps, run tests, install dependencies via npm or brew, and commit changes directly to your repositories. While this dramatically increases developer velocity, it also introduces a massive security paradigm shift.

Giving an autonomous agent full access to your primary workstation is a security nightmare. If Claude Code is targeted by a prompt injection attack (for example, reading a malicious README in a cloned repository), it could theoretically execute arbitrary shell commands. This could result in the exfiltration of your private SSH keys (~/.ssh), stealing active AWS or GCP session credentials from your environment variables, or compromising your local network.

To safely harness the power of agentic tools, you need a physical air-gap or a highly isolated environment. Repurposing a spare Mac (whether an older Intel model or an entry-level Apple Silicon Mac mini) as a dedicated AI sandbox is the ultimate solution. This guide walks you through setting up a hardened, self-healing macOS agent host from scratch.

Threat Modeling the Agent Host

Before executing commands, we must define the threat model and our security objectives for the spare Mac:

Data Isolation: The agent must not have access to your primary work files, private keys, or passwords.
Network Isolation: The agent must only connect to authorized external endpoints (like Anthropic's API and GitHub) and should be blocked from scanning or connecting to other devices on your local home network (LAN).
System Resilience: If the agent executes a destructive command (e.g., rm -rf / or recursive system modifications), we must be able to restore the system to a clean state in under 10 seconds without reinstalling the OS.

To achieve this, we will combine APFS Volume Isolation, macOS Packet Filter (PF) firewall rules, non-privileged user accounts, and APFS snapshot rollbacks.

Phase 1: Provisioning a Dedicated APFS Sandbox Volume

Rather than running the agent on your main macOS startup volume, we will create a dedicated APFS volume. APFS (Apple File System) allows volumes to share free space dynamically, meaning this won't permanently eat up your storage.

Open your terminal on the spare Mac and list your current disks:
```
diskutil list
```
Add a new APFS volume named Sandbox to your primary APFS container (typically disk3 or disk1 depending on your Mac):
```
diskutil apfs addVolume disk3 APFS Sandbox -role T
```
(Note: The -role T flag marks it as a backup/target volume, keeping it clean from standard system clutter.)

This isolated volume will host all of Claude's workspace directories. If anything goes wrong, we can instantly format or revert this single volume without affecting the core operating system.

Phase 2: Hardening the Operating System and SSH Access

To control your spare Mac from your primary workstation, you will use SSH. We need to lock down SSH access so that only your primary machine can connect, and the remote execution environment is heavily restricted.

1. Create a Restricted User Account

Do not let Claude run under an Administrator account. Create a standard, non-privileged user named claude-agent on the spare Mac via System Settings > Users & Groups.

2. Configure SSH Key-Based Authentication

Log into the spare Mac, open terminal, and restrict SSH access. Edit the sshd configuration file:

sudo nano /etc/ssh/sshd_config

Add or modify the following directives to disable password authentication and restrict access solely to the claude-agent user:

PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers claude-agent
PermitRootLogin no

Restart the SSH daemon to apply changes:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist

On your primary workstation, copy your public SSH key to the spare Mac:

ssh-copy-id -i ~/.ssh/id_ed25519.pub claude-agent@<spare-mac-ip>

Phase 3: Sandboxing Network Access via macOS Packet Filter (PF)

To prevent a compromised agent from scanning your local network or accessing internal smart devices, we will configure the macOS built-in Packet Filter (pf) firewall to block local network traffic while allowing outbound access to the internet.

Create a custom rules file at /etc/pf.anchors/claude-sandbox:
```
sudo nano /etc/pf.anchors/claude-sandbox
```

Paste the following configuration, adjusting the interface (en0 for Wi-Fi/Ethernet) and your local subnet as necessary:

# Variables
ext_if = "en0"
local_net = "192.168.1.0/24"

# Default deny rule for local network
block out on $ext_if proto { tcp, udp } to $local_net

# Allow DNS resolution
pass out on $ext_if proto udp to any port 53

# Allow standard HTTP/HTTPS out to the wider internet
pass out on $ext_if proto tcp to any port { 80, 443 }

Reference this anchor in the main /etc/pf.conf file. Open /etc/pf.conf and add these lines under the placeholders:
```
anchor "claude-sandbox"
load anchor "claude-sandbox" from "/etc/pf.anchors/claude-sandbox"
```
Enable and test the firewall:
```
sudo pfctl -ef /etc/pf.conf
```

Verify that the spare Mac can still ping api.anthropic.com but cannot ping your primary workstation or local router.

Phase 4: Installing and Configuring Claude Code

Now that our host is hardened, let's install Claude Code under our restricted claude-agent user account.

1. Install Node.js via FNM (Fast Node Manager)

Avoid using global homebrew installations for the agent's Node environment. Instead, use a localized node manager:

curl -fsSL https://fnm.vercel.app/install | bash
source ~/.zshrc
fnm install --lts

2. Install Claude Code

Install the package globally within your user-space Node environment:

npm install -g @anthropic-ai/claude-code

3. Expose the API Key Securely

Do not hardcode your Anthropic API key in shell configuration files. Instead, pass it dynamically when starting your SSH session, or retrieve it from a secure keychain. For this setup, we will configure a secure session-specific environment variable:

export CLAUDE_API_KEY="your-api-key-here"

Initialize Claude Code to complete the authentication handshake:

claude

Phase 5: Automating the Sandbox Rollback Loop

To make this setup truly resilient, we will write a shell script on our primary machine that automates taking an APFS snapshot of the sandbox volume before running Claude, and automatically rolls back the environment if a task fails or finishes.

APFS allows us to create instantaneous snapshots using the tmutil or mount_apfs command utilities.

Create a script named agent-session.sh on your primary workstation:

#!/bin/bash
set -e

SPARE_MAC_IP="192.168.1.50"
AGENT_USER="claude-agent"
VOLUME_PATH="/Volumes/Sandbox"

echo "[+] Connecting to spare Mac to create APFS pre-run snapshot..."
ssh $AGENT_USER@$SPARE_MAC_IP << 'EOF'
  # Create a local snapshot of the Sandbox volume
  sudo tmutil localsnapshot /Volumes/Sandbox
EOF

echo "[+] Starting Claude Code Session. Control passing to agent..."
ssh -t $AGENT_USER@$SPARE_MAC_IP "cd /Volumes/Sandbox && claude"

echo "[-] Claude session ended."
read -p "Do you want to rollback the Sandbox volume to the pre-run state? (y/n): " confirm

if [ "$confirm" = "y" ]; then
  echo "[+] Rolling back Sandbox volume..."
  ssh $AGENT_USER@$SPARE_MAC_IP << 'EOF'
    # Find the latest snapshot
    LATEST_SNAP=$(tmutil listlocalsnapshots /Volumes/Sandbox | tail -n 1 | awk '{print $NF}')
    # Unmount volume to perform rollback
    diskutil unmount /Volumes/Sandbox
    # Revert to snapshot
    sudo apfs_revert /Volumes/Sandbox -s "$LATEST_SNAP"
    # Remount
    diskutil mount /Volumes/Sandbox
EOF
  echo "[+] Rollback complete. Sandbox is clean."
else
  echo "[!] Skipping rollback. Changes preserved."
fi

Make the script executable:

chmod +x agent-session.sh

Verification: Putting Your Agent Host to the Test

Run your automated script:

./agent-session.sh

This SSHes you directly into the isolated sandbox environment. Try asking Claude to perform complex tasks, such as cloning an open-source project, installing its dependencies, and running a test suite.

You can monitor Claude's actions in real-time. If it attempts to run a malicious package or execute a destructive bash command, the pf firewall will block unauthorized outbound network access, and your standard user privileges will prevent system-level modifications. Once the session is closed, the script prompts you to instantly wipe the slate clean, restoring the APFS volume back to its pristine state in milliseconds.

By isolating agentic execution to a dedicated, hardened spare Mac, you protect your primary workstation, secure your production credentials, and gain a robust, low-latency environment to explore the bleeding edge of AI-driven development.