Full Report
Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone cannot tell you whether an agent’s access is legitimate. AI has moved from the browser tab to the
Analysis Summary
# Best Practices: Securing Claude Code & Local AI Agents
## Overview
These practices address the security risks associated with "harnesses"—local AI agents like Claude Code that operate on developer endpoints. Unlike browser-based chatbots, these agents possess the ability to execute shell commands, access local files, and leverage the developer's existing credentials. The goal is to move from passive logging to active governance by combining cloud-based compliance APIs with endpoint telemetry.
## Key Recommendations
### Immediate Actions
1. **Locate Managed Settings:** Identify the local configuration files (JSON on Mac/Linux; Registry on Windows) that control Claude Code behavior.
2. **Enable Compliance API:** Activate Anthropic’s new compliance endpoints to begin capturing session transcripts and activity logs.
3. **Inventory Agents:** Use EDR (Endpoint Detection and Response) tools to scan for `claude-code` binaries and associated processes to identify "Shadow AI" usage.
### Short-term Improvements (1-3 months)
1. **Standardize Policy Baselines:** Use MDM (Mobile Device Management) to push a `managed-settings` record to all developer machines, overriding user-level agent permissions.
2. **Telemetry Integration:** Create a pipeline to ingest Anthropic Compliance API logs into your SIEM (Security Information and Event Management) platform.
3. **Credential Review:** Audit which environment variables and credentials (e.g., AWS keys, GitHub tokens) are accessible to the shell environment where Claude Code runs.
### Long-term Strategy (3+ months)
1. **Identity Governance for Agents:** Implement a model that connects agent activity not just to a machine, but to a specific user intent and authorized credential set.
2. **Automated Response:** Develop playbooks to automatically kill agent processes or revoke session tokens if destructive commands (e.g., unauthorized file deletions or mass data exfiltration) are detected.
3. **MCP Server Hardening:** Establish a whitelist of approved Model Context Protocol (MCP) tools and third-party plugins that agents are permitted to invoke.
## Implementation Guidance
### For Small Organizations
- Focus on the **Enterprise Plan GUI** for Anthropic to manage policies without needing complex infrastructure.
- Manually audit developer machines for local agent installations.
### For Medium Organizations
- Use **MDM tools** (Jamf, InTune) to enforce the `managed-settings` JSON/Registry files globally.
- Rely on existing EDR alerts for suspicious bash command execution initiated by AI processes.
### For Large Enterprises
- Deploy a **three-layer visibility strategy**: Managed settings (policy), Compliance API (cloud logs), and Endpoint Telemetry (local process monitoring).
- Integrate AI agent logs into a central SOC (Security Operations Center) for cross-domain correlation.
## Configuration Examples
*Based on the "Managed Settings" architecture described:*
**Example: Mac/Linux Managed Settings Path**
`~/.config/claude-code/managed-settings.json`
**Example Policy (Conceptual JSON):**
json
{
"allow_shell_execution": true,
"restricted_commands": ["rm -rf /", "chmod 777"],
"enforce_mcp_whitelist": true,
"logging_enabled": true
}
## Compliance Alignment
- **NIST AI RMF:** Aligns with the "Govern" and "Map" functions by identifying agent capabilities and enforcing policy.
- **CIS Controls:** Specifically Control 5 (Account Management) and Control 10 (Malware Defense) via endpoint monitoring.
- **ISO/IEC 42001:** Addresses AI management system requirements for monitoring and logging.
## Common Pitfalls to Avoid
- **Logging Fallacy:** Assuming that having logs (visibility) is the same as having control (governance). Logs do not tell you if an action was *intended* by the user.
- **Shared Responsibility Confusion:** Expecting Anthropic to secure the local endpoint. The "brain" is in the cloud, but the "hands" (the harness) are your responsibility.
- **Credential Inheritance:** Overlooking that agents automatically inherit the high-level permissions of the developer's terminal.
## Resources
- **Anthropic Compliance API Documentation:** [hXXps://docs.anthropic.com/en/api/compliance]
- **Token Security Agentic Pulse Report:** [hXXps://www.token.security/the-agentic-pulse]
- **Cloud Security Alliance (CSA) AI Governance:** [hXXps://cloudsecurityalliance.org/artifacts/ai-security-data-report]