FollowAgents AI AGENTS DIRECTORY
Home / AI Agent Glossary / Agent Sandbox (Sandboxed Execution)
Evaluation & Safety

Agent Sandbox (Sandboxed Execution)

Also called: sandboxed execution · AI sandbox · code sandbox

An agent sandbox is an isolated execution environment, such as a container, microVM, or restricted OS process, in which an AI agent runs code and commands with limited access to files, network, and credentials.

Agents that can run shell commands and write files are powerful and, if they err or are manipulated, dangerous. A sandbox limits the damage: the agent works inside a boundary where the worst case is a broken sandbox, not a wiped laptop or leaked credentials.

Sandboxes are a form of deterministic-guardrails. Rather than trusting the model to behave, the environment enforces limits, and it works even when the model has been fooled by prompt-injection.

Strength varies by mechanism. Containers share the host kernel and are lighter; microVMs and virtual machines provide a stronger boundary at more cost; OS-level sandboxes restrict a normal process. Many coding agents also combine a sandbox with permission prompts.

How it works

A sandbox typically restricts several dimensions: filesystem (only a working directory is writable), network (deny by default or allow-list hosts), resources (CPU, memory, time limits), and secrets (no ambient credentials, only scoped tokens injected when needed). The agent's tool calls execute inside, and results are returned out. Persisting state between steps, for example installed packages or a checked-out repository, is a common design choice.

Example

A coding agent is told to run a project's test suite. It runs inside a container with the repository mounted read-write, network limited to the package registry, and no access to the developer's home directory. A malicious test script that tries to read SSH keys or upload files finds nothing to take and nowhere to send it.

How it differs

Sandbox vs. permission prompts: a prompt asks a person to approve each action, which is human-in-the-loop and can suffer from approval fatigue. A sandbox limits what any approved or unapproved action can do. They are often used together.

Common misconceptions

Often assumed: Running an agent in a container makes it completely safe.
Actually: Containers share the host kernel and can be misconfigured; network access or mounted secrets inside the sandbox can still be abused. Isolation reduces risk but is only as strong as its configuration.

FAQ

What is an agent sandbox?
An isolated environment where an AI agent runs code and commands with restricted access to files, network, and credentials, limiting damage from mistakes or attacks.
Do coding agents need a sandbox?
It is strongly advisable for anything that executes commands, especially with untrusted input, because a sandbox limits the impact even if the model is tricked or wrong.
What is the difference between a container and a microVM sandbox?
Containers are lighter but share the host kernel; microVMs run a separate kernel for stronger isolation at higher overhead.

Last checked: 2026-09-20

Related terms

AI Agent Guardrails

A guardrail is a rule, filter, or check applied to an agent's inputs or proposed actions that constrains what it's allowed to do, enforced independently of the agent's own reasoning.

Deterministic Guardrails

Deterministic guardrails are constraints on an agent enforced by ordinary, non-probabilistic code — state machines, policy engines, pre- and post-condition checks, allow-lists — so that required steps happen in a fixed order with fixed outcomes, no matter what the model decides.

AI Agent Safety

Agent safety is the practice of anticipating and limiting the harm an AI agent could cause once it can take real actions in the world, not just generate text.

Prompt Injection

Prompt injection is an attack in which text inside the content a model reads — a web page, a document, an email, a tool result — is crafted so the model treats it as an instruction and acts on it, overriding what the developer or user actually asked for.

Coding Agent Harness

A coding agent harness is the surrounding software — outside the model itself — that assembles context, executes tool calls, enforces permissions, and feeds results back, turning a raw model into something that can actually operate a coding environment.