Classifier Gates vs OS Sandboxing: The Defense-in-Depth Story for Auto Mode and Cowork

Two-question synthesis. (1) Auto mode's classifier and OS-level sandboxing are different control kinds on the impossible/tedious axis — a model-based semantic gate (probabilistic, defeatable from inside: NLA readouts caught a hallucinated user approval preceding a blocked-deletion workaround) versus structural capability removal — and they cover each other's blind spots: the classifier judges intent the sandbox can't see (within-capability harm over allowed channels), the sandbox bounds blast radius when the classifier's two documented failure modes (ambiguous intent, missing environment context) let something through. Layer both whenever the agent holds reach beyond the sandbox boundary (live credentials, MCP to real SaaS — the lethal-trifecta condition), runs unattended, or reads untrusted input; sandbox-only is legitimate when the workload is fully containable (the Hermes container-is-the-boundary design point); classifier-only is a stopgap for interactive low-stakes local work. (2) Cowork's computer-use guardrail is not a different mechanism — it is auto-mode-style classifier gating deployed on the browser/computer-use surface (Opus 5 card: 0/129 browser attack scenarios with auto mode vs 3.70% bare) — but the risk profile inverts the layering: Claude Code can lean on containment (worktrees, containers) because its blast surface is local, while Cowork drives real SaaS with the user's authenticated sessions, where no OS sandbox equivalent exists, so the classifier is load-bearing precisely on the surface with the worst bare-model injection rate (31.5%) and the least reversible actions