Agent sandbox

An agent sandbox is a containment boundary for code whose behaviour is chosen at runtime by a model that can be wrong or manipulated. The threat model therefore assumes that any command inside the boundary may be hostile, and the design question is what that command can read, write, execute and reach over the network. Isolation strength forms a spectrum. Process-level sandboxes apply kernel policy to an ordinary process: seccomp-bpf syscall filters and Landlock on Linux, unprivileged namespace tools such as bubblewrap, and the Seatbelt framework on macOS. Containers add namespaces and cgroups but still share the host kernel, so a kernel vulnerability can become an escape, a limitation NIST SP 800-190 discusses at length. gVisor interposes a user-space kernel that services most syscalls itself, and microVMs such as Firecracker give each workload its own KVM guest kernel while booting in around 125 ms with a few MiB of memory overhead, which is why many hosted code-execution services use them.

The filesystem policy usually mounts only the working directory read-write, keeps system paths read-only, and deliberately omits credential locations such as ~/.ssh, ~/.aws or browser profiles. Network policy is typically default-deny egress with an allowlist enforced by a proxy, since blocking only by IP misses DNS-based exfiltration and CDN-hosted endpoints. Credentials that the task genuinely needs should be short-lived and narrowly scoped, and some designs never expose them inside the sandbox at all, letting the egress proxy inject them into requests to approved hosts. Ephemerality matters as much as walls: a fresh sandbox per task prevents persistence, and snapshots make it cheap to reset.

Claude Code's sandboxed Bash tool illustrates a local implementation: it uses Seatbelt on macOS and bubblewrap plus a socat-relayed proxy on Linux and WSL2, allows writes to the working and session temp directories by default, and restricts egress to allowed domains. Notably, if dependencies are missing it warns and runs unsandboxed unless configured to fail closed, a detail auditors should check.

Common misconceptions: a sandbox does not stop prompt injection, it bounds its blast radius; and it does not neutralise misuse of channels it allows. An agent permitted to push to GitHub can exfiltrate through a commit, and code written inside the sandbox may plant a malicious git hook or CI step that executes later outside it. The sandbox is thus the enforcement mechanism for least privilege, complementary to human-in-the-loop approval, and it reduces the approval fatigue that arises when every command needs a click.