Sandboxes Are Capability Containers

Put the agent in a container and call it safe.

That sentence compresses several different security questions into one comforting image. A process may be isolated from the host and still have production credentials, unrestricted network access, a mounted customer-data volume, and permission to publish whatever it produces.

The walls held. The capability leaked through the doors.

For AI agents, a sandbox is not merely a place where code runs. It is the complete boundary around what the operation can observe, change, communicate with, preserve, and carry forward.

Isolation is one mechanism. Capability containment is the objective.

Start With the Consequence Boundary

Sandbox design often begins with technology: virtual machine or container, operating-system profile, network namespace, browser isolation.

Begin instead with the task.

What inputs does this operation need? What artifacts may it create? Which external systems can it contact? What would become consequential if compromised or simply wrong? What evidence must leave the sandbox, and what data must never leave?

A code-review agent may need read access to one repository and permission to write a patch artifact, but no network or merge capability. A deployment agent may need one artifact digest, one environment, and one narrowly scoped deployment tool. A research agent may need the open web but no internal secrets.

The sandbox should be shaped around the smallest authority that can complete the task. Generic “agent environments” tend to accumulate privileges until isolation becomes ceremonial.

Constrain Inputs as Aggressively as Outputs

Security discussions focus on what an agent can write. What it can read matters just as much.

A mounted home directory may contain SSH keys, cloud credentials, unrelated repositories, browser state, and personal documents. Environment variables can reveal secrets the current tool never needed. Broad database access can turn a harmless summarization task into a data-exfiltration path.

Build the workspace from explicit inputs. Copy or mount only the required files. Inject short-lived credentials for the specific capability. Keep host paths, process metadata, and secret stores outside the namespace by default.

This also improves reliability. A model cannot become distracted by or accidentally modify information it never received.

Network Access Is a Tool

Unrestricted egress is often treated as the default backdrop of computation. For an agent, it is an enormous composite capability.

Network access can retrieve untrusted instructions, transmit sensitive context, invoke effects through unofficial paths, and create covert dependencies that traces do not capture. DNS alone can reveal data. A package installer can execute remote code. A browser can carry ambient authentication.

Treat network destinations and protocols as explicit tools. Allow the documentation host for a research step, the package registry for an approved install, or the deployment API for a release operation. Route traffic through an observable proxy that enforces destination, method, size, and identity where appropriate.

When open-web access is genuinely required, separate that research environment from sensitive data and effectful credentials. One sandbox does not need to contain every phase of the workflow.

Credentials Should Follow the Step

Long-lived credentials inside a general agent runtime turn any prompt-injection or tool-selection failure into a privilege problem.

Issue capability tokens for the current operation: one repository, one action class, one environment, one time window. Bind them to the operation identity and record their use. Revoke them when the step ends or waits.

The agent should not decide which ambient credential to pick from a keychain. The harness should present only the authority selected by policy.

For consequential actions, a two-stage flow works well. Preparation happens without write authority. Approval produces a short-lived grant tied to the exact artifact. Commitment occurs in a fresh environment that contains only that artifact and grant.

This makes privilege a transition, not a permanent property of the agent.

Persistence Must Be Deliberate

An ephemeral sandbox limits contamination, but agent work needs continuity.

The answer is not to preserve the entire environment forever. Persist typed artifacts and durable workflow state: patches, reports, source manifests, operation receipts, and checkpoints. Discard caches, shell history, downloaded clutter, and credentials unless a clear purpose requires them.

Each exported artifact should cross an inspection boundary. Scan files, validate expected types, reject unexpected executables, and attach provenance. A model-generated archive should not become trusted merely because it originated inside the sandbox.

Durability belongs to the workflow record. Environmental residue should not become accidental memory.

Time and Compute Are Security Controls

An agent with bounded filesystem access can still consume unlimited CPU, memory, storage, network bandwidth, or paid API calls.

Resource limits protect availability and constrain runaway behavior. Set wall-clock deadlines, process limits, storage quotas, output-size limits, network budgets, and model-call budgets appropriate to the task.

The limits should produce a legible stop. A workflow that hits a budget should preserve its artifacts and uncertainty, not corrupt state or claim completion. Operators need to distinguish a reasoned refusal from a killed process.

Resource constraints are also useful against hostile inputs designed to trigger decompression bombs, recursive traversal, huge tool output, or expensive loops.

Observe the Boundary From Outside

Logs written only inside the sandbox can be altered by the same process being observed.

Capture tool calls, network decisions, credential issuance, file exports, policy denials, and resource events in an external control plane. Associate them with the durable operation identity. Keep enough information to reconstruct effects without copying every sensitive payload into a new store.

The boundary should also support intervention. A policy engine can revoke network access, freeze exports, expire a lease, or terminate the environment when an invariant breaks.

This is containment as an active system, not a static wall.

Sandboxing Does Not Replace Tool Safety

A perfectly isolated agent can still misuse the one powerful tool it is allowed to call.

If a deployment function accepts an arbitrary environment, or a payment tool cannot reconcile ambiguous outcomes, process isolation does not repair the contract. The sandbox limits collateral paths; tool contracts define the permitted path itself.

Likewise, a sandbox does not validate the correctness of an artifact. Generated code can be wrong without escaping anything. Verification and review remain separate controls.

Defense works when the layers have distinct jobs: model policy shapes behavior, tool contracts constrain operations, sandboxing limits ambient capability, approval grants authority, and verification checks effects.

Test the Doors, Not Only the Walls

Sandbox tests often prove that a process cannot read a host file or escape a container. Agent tests should probe every intended opening.

Can retrieved content cause the agent to use an allowed network path for exfiltration? Can a symlink smuggle an outside file into an exported artifact? Can a child process outlive the task? Can the model reach a metadata service? Can a tool response convince it to reveal a credential through another permitted tool? Does the environment retain data for the next tenant?

Exercise policy changes during the run. Revoke access while the agent waits. Rotate the operation token. Resume the workflow in a clean environment and verify that only approved state returns.

The strongest boundary is the one whose failure modes have been rehearsed.

Contain Capability, Preserve Usefulness

A sandbox should not make the agent incapable. It should make capability specific.

Shape the environment around the task. Admit only necessary data. Treat the network as a set of explicit tools. Issue authority per step. Export typed artifacts. Bound resources. Observe from outside. Test every controlled opening.

The goal is not to imprison intelligence.

It is to create a place where powerful work can happen without turning every available system into part of the blast radius.