Claude routinely tries to install software if I don't stop it. I try to only use Claude within a container. Outside the container, I never use "auto" mode. I have the sandbox

Ideally I would never use Claude at all outside a container, even on a box with no sensitive information. It's like having an attacker breach your system — you don't know what it did.