Agent Sandboxing
An agent that can run code or drive a computer is, from the host's point of view, an unpredictable program with a plan of its own. Agent sandboxing is the practice of giving it a bounded place to work — a container, a virtual machine, a restricted browser profile — where its actions are confined and, ideally, disposable.
What the boundary covers
A sandbox is a set of specific limits rather than one setting:
- Filesystem — a scratch workspace, with home directories and credential files out of reach.
- Network — egress denied by default or allowed only to an explicit list, so a leaked secret has nowhere to go.
- Resources — CPU, memory, disk and wall-clock caps, so a runaway process dies instead of taking the machine with it.
- Lifetime — an environment created per task and destroyed afterwards.
Why it is the defence that holds
Prompt-level rules ask a model not to misbehave; a sandbox makes misbehaviour harmless. That distinction matters because an agent can be led astray by content it merely reads, so it will sometimes attempt a bad action through no fault of its instructions. Code-execution tools, coding agents and computer-use agents are deployed this way by default — SWE-bench evaluations give each task its own container for the same reason.
Why it matters
Sandboxing is what lets an agent hold real capability without the operator accepting unlimited exposure. Too tight and the agent cannot finish its work; too loose and every other control reduces to trust.
Agent sandboxing confines an agent's execution to an isolated environment — a container, virtual machine, or restricted filesystem — so its actions cannot reach resources outside that boundary. Code runs, files are written, and commands execute without risk to the host or production data. Sandboxing is containment rather than prevention: it assumes the agent will eventually take a wrong or attacker-induced action and bounds the damage when it does.
Chemists do risky work inside a fume cupboard — not because they expect an accident, but because the cupboard keeps one inside it. Agent sandboxing is a fume cupboard for software.
When AI software is allowed to run programs or use a computer by itself, it gets its own sealed-off workspace: copies of just the files it needs, no access to your passwords, and usually no route out to the wider internet. When the job is finished, the workspace is thrown away.
The point is that it stops mattering whether the software makes a mistake or is tricked into one. Either way, the mess has nowhere to spread.