Stage 1 of the sandbox rollout names op, docker and ssh in
sandbox.excludedCommands. Whether that actually lifts them out of the sandbox depends on
the environment, and the settings file gives you no hint either way. Pick an environment to trace the
real decision function. Issue #3322, rollout #3424.
N7(), the sandbox decision function (CC 2.1.235)
What that means for the three carve-outs
Command
Your machine
Forced sandbox
op
runs unsandboxed, biometrics work
wrapped, may fail
docker
runs unsandboxed
daemon socket denied
ssh
runs unsandboxed
TCP connect EPERM, raw DNS dead
The forced-sandbox column is measured, not predicted: observed 2026-08-19 from inside Claude Code's
own sandboxed Bash, with those exact commands named in excludedCommands.
The two conclusions, held together
No exfil surface
Naming these commands does not punch a hole in an enterprise policy sandbox.
The forced check returns before the list is ever read.
Not an escape hatch either
A tool needing real host access still fails there, while the settings file looks correct.
Debug it as a forced-sandbox condition, not as a typo in the list.