Claude frequently has decided to disable its own sandbox when I've had it running so I absolutely do not trust their implementation. Wrapping with `nono` or `sbx` has mitigated that on my side.