Someone reverse-engineered Claude Code's sandbox and found Antspace
Two things happened while the industry argued about slowing down: someone took apart the machine Claude Code actually runs on, and David Sacks called the slowdown pitch a cartel.
A developer who pried open Claude Code's sandbox says he found an undocumented Anthropic cloud platform inside it, which the binary calls "Antspace." AprilNEA, a security researcher who published his methodology and the decompiled artifacts, reported that every Claude Code web session is a Firecracker microVM — the same open-source virtual machine monitor Amazon built for Lambda — with no systemd, no sshd, no cron and no logging daemon. The single process that runs everything is a 3.1MB Rust binary that acts as both init and a control API, listening on two local ports so the host can spawn processes, stream their output and kill them without the guest ever having a network stack to escape through. Extracting strings from the sandbox's own Go binary, he says, revealed a full deployment protocol — build, upload, promote, rollback — pointing at a platform with zero public documentation. Anthropic has publicly described its sandboxing approach but has never announced anything called Antspace, and it did not comment.
The part that reads like a product roadmap is what else came out of the binary. Sessions don't boot; they're restored from frozen snapshots, and one machine's own kernel log showed a 48.5-hour gap between a template being built and a session resuming from it, which is what fleet-scale, spin-up-in-seconds infrastructure looks like from the inside. The same analysis turned up "Baku," reportedly the internal name for the web app builder on claude.ai, wired with six always-available MCP tools and a stop-hook that refuses to end a session early, plus a seven-endpoint "bring your own cloud" interface — meaning a customer's own account, not Anthropic's. AprilNEA's read, and it's hard to argue with: Anthropic didn't wrap Vercel, it wrote its own deployment protocol, which is what a company does when it intends to own the layer. The competitive framing matters less than the capability question: the same isolation boundary that makes agent sandboxes safe is the thing we told you was flimsy — see AI 101 — What is a sandbox escape? and DeepSeek's agent tool let the agent switch off its own sandbox.
David Sacks, Trump's former AI czar, told Anthropic and OpenAI they can "pace the frontier" today and should stop asking for anything in return — and accused the pacing push of being regulatory capture dressed as conscience. In a long post on X, he wrote that if the labs really believe their models are dangerous, slowing down is "simply good business" because product-liability exposure from a damaging cyberattack dwarfs any first-mover bonus, adding that demanding a friendly regulatory framework as the price of restraint "will look like blackmail of the public and the political system." He also went after the referee, questioning whether METR — the evaluator Anthropic invited in — is genuinely independent given its ties to the company's investors and staff.
Sacks' preferred enforcement mechanism is courts and liability rather than a licensing regime, which is roughly the path the EU already took: it withdrew its standalone AI Liability Directive in February 2025 and now treats software as a product under strict liability from 9 December. That's the interesting split inside the slowdown camp — the labs want a negotiated framework with antitrust cover, since we covered OpenAI asking Congress whether an industry-wide slowdown was even legal, while the White House wants the market to punish unsafe models by itself, and Amodei's own plan puts outside auditors inside Anthropic as the compromise.
What to watch: whether Anthropic or OpenAI names Antspace publicly, and whether the pacing camp accepts a liability-only discipline without a written framework.
If a lab ships the platform as well as the model, is the "just slow down" argument even coherent any more? Tell us in the comments.
Sources: AprilNEA — Reverse-Engineering Claude Web's MicroVM · reverse-engineering-claude-code-antspace (GitHub) · BlockBeats · Anthropic — Claude Code sandboxing · Washington Examiner · The Next Web · CBS News · Techmeme
