I Had Claude Code on the Web Dissect Its Own Sandbox

I asked the Claude running in my Slack "where are you running?" and had it reconstruct its own execution environment from ps, /proc, and binary inspection. The answer: Firecracker microVM isolation plus a mandatory built-in allowlist proxy for all egress. The next day I red-teamed that boundary — none of the exfiltration paths I tried worked.