Agent Sandbox

An agent sandbox is an isolated execution environment where an agent's generated code, shell commands or file operations run without reaching anything that matters. It is not a testing tenant of a SaaS product; it is a containment boundary around actions the model chose, built on the assumption that some of them will be wrong or hostile. The assumption is warranted, because an agent's inputs include documents, web pages and tool results, all of which can carry instructions, so an agent that executes code is executing text from sources nobody controls. A sandbox is defined by what it denies. A filesystem scoped to a working directory, with no path to credentials or to the host. A network policy that denies egress by default and permits a named set of destinations, which is the single control that keeps data from leaving even when the code is malicious. No ambient cloud identity, because an instance role or a mounted credential file turns arbitrary code into arbitrary infrastructure access. Resource and time limits, so a runaway process ends by itself. And a lifetime of one run, discarded afterwards, so nothing persists between tasks that were never meant to share state. Two design points follow. The sandbox needs a deliberate, narrow way to return results, such as a mounted output path or a structured response, because the standing temptation is to loosen the boundary to make the plumbing convenient and every loosening turns out to be permanent. And escalation should be explicit: when a task genuinely needs a credential or a network destination, grant it for that task, make it visible in the trace, and let it expire, rather than adding it to the default image where nobody will re-examine it.