Agent Sandbox

An agent sandbox confines what an AI agent's actions can touch. An agent that runs shell commands, edits files, and browses the web is executing instructions generated by a model, which can be wrong, and which can be steered by text it reads along the way. A sandbox limits the damage: the agent works freely inside a boundary, and anything outside, such as other files, credentials, the network, or the host machine, is unreachable or requires approval.

Sandboxing answers a question that Guardrail prompts cannot. Instructions to a model are suggestions; a sandbox is enforced by the operating system, so it holds even when the model is confused or compromised through Prompt Injection. It applies Least Privilege: give the agent only what the task needs.

A sandbox restricts several things:

• Filesystem. Writes limited to the project directory, with home directories, SSH keys, and cloud credentials hidden.
• Network. Outbound connections limited to an allowlist of hosts, much like a Firewall, so stolen data has nowhere to go and unknown packages can't be fetched.
• Processes. Child processes inherit the same limits, so a script the agent runs is confined too.
• Resources. CPU, memory, and time caps keep a runaway loop from taking over the machine.

The mechanisms come from ordinary systems security. On Linux, Linux Namespaces give a process its own view of files, processes, and network, Control Groups cap resources, and seccomp filters which System Call requests are allowed; tools such as bubblewrap combine them without a full container. macOS has its Seatbelt sandbox profiles. Stronger isolation uses gVisor, which intercepts system calls in user space, or microVMs such as Firecracker, released by AWS in 2018, which boot a lightweight virtual machine in a fraction of a second. Browsers and WebAssembly runtimes offer sandboxes for code that never needs a real OS.

Permission prompts are the softer layer: ask before running a command or editing a file. They work until people approve everything reflexively, and approval fatigue sets in fast. Good designs prompt rarely and meaningfully, auto-approve what the sandbox already makes safe, and reserve Human in the Loop approval for actions that escape it or cannot be undone.

Simon Willison named the lethal trifecta in 2025: an agent with access to private data, exposure to untrusted content, and the ability to communicate externally can be tricked into leaking that data. Removing any one leg, most often outbound network access, breaks the attack.

Recovery complements confinement. A Filesystem Snapshot or Copy-on-Write layer lets a bad run be thrown away, and running Background Agent tasks in disposable containers or cloud machines makes the whole environment expendable. Sandboxing also protects against the Supply Chain Security risk of an agent installing a malicious package it was tricked into choosing.