Anthropic open-sourcing the sandbox layer behind Claude Code is a telling move: agent security is graduating from blog-post advice to shipped infrastructure. The technical choice is pragmatic rather than novel — Seatbelt and bubblewrap are long-standing OS primitives — but wrapping them for the agent era, with MCP servers explicitly in scope, shows the team understands where prompt injection actually turns into damage: file and network access. In our view, the real significance is standard-setting; if srt becomes the default for local agent runs, container-free isolation could become table stakes for anyone shipping autonomous agents. Expect rival labs and agent frameworks to ship equivalents or adopt this within months. Not a breakthrough, but a quietly important piece of the agent stack.