Agent securityMiddleLesson 185 min read

Sandboxing: the room with no windows

You cannot stop the agent being fooled. You can decide what room it is standing in when it happens.

🧪 Lab · 20 min📝 Lesson test
Lesson in motion

In 60 seconds

Sandboxing: the room with no windows

You cannot stop the agent being fooled. You can decide what room it is standing in when it happens.

1/5
In simple words
Let the robot play in a room with padded walls and nothing valuable in it. If it goes haywire, it breaks a cushion instead of your television.
A sandbox is a restricted environment where an agent can act, chosen so that the worst possible outcome is acceptable. It is the defence that keeps working when every other one has failed, which is why it belongs near the bottom of your stack, holding everything up.

The four walls

  1. 1

    Filesystem

    Its own directory or container. No host mounts. No access to ~/.ssh, ~/.aws, browser profiles or credential stores. A copy of what it needs, nothing more.
  2. 2

    Network

    Deny by default, allow-list by exception. Block internal ranges and cloud metadata endpoints. Remember DNS — a lookup leaks data even when the connection is refused.
  3. 3

    Credentials

    No ambient environment secrets. Short-lived, narrowly scoped tokens issued per run, and revocable in one action.
  4. 4

    Resources

    CPU, memory, wall-clock time, spend. A runaway agent should hit a wall in seconds, not on your monthly invoice.
THE SANDBOXThe agentScratch filesTemp tokenAllowed: api.yourco.com onlyblockedProduction databaseYour SSH keysInternal admin panelThe open internetworst case stays inside the dashed line
The dashed line is the promise. Everything an injected agent can reach is inside it, and everything inside it is cheap to lose.

Levels of isolation

LevelWhat it isGood againstWeak against
ProcessRun as a low-privilege userAccidental file accessA determined escape
ContainerDocker or similarMost practical attacksKernel-level escapes, shared network
VMA whole virtual machineNearly everything technicalCost and start-up time
Separate machinePhysically isolated hostBlast radius on your networkComplexity
EphemeralDestroyed after every runPersistence of any kindNothing — this is the best habit on the list
Do this
Ephemeral is the highest-value word here. A fresh environment per run means anything an attacker managed to establish — a file, a cron entry, a modified config — is gone within minutes and cannot follow the next user.

What a sandbox does not do

  • It does not stop the agent being fooled. It only limits what a fooled agent reaches.
  • It does not protect data you deliberately put inside it. If you mounted the customer database, the sandbox is protecting an empty room.
  • It does not cover the tools you gave it. A perfectly sandboxed agent with a live send_email tool can still email your secrets to the world.
Watch out
Sandboxing is about the environment. Least privilege is about the tools. You need both, and teams that do one and skip the other usually skip the tools half — which is the half that actually reaches the outside world.

Watch and read more

Container security basicsYouTube searchSandboxing AI agentsYouTube search

Lab

A sandbox you have actually tried to break out of.

~20 min

The problem

Run agent-generated code in a container with the hardening flags from Module 66. Then attack your own sandbox: read a host file, make a network call, exhaust memory, fork-bomb it, and leave something behind that survives the next run. Each one you succeed at is a missing flag.
Starter codebash
docker run --rm \
  --network none --memory 256m --cpus 0.5 --pids-limit 64 \
  --read-only --tmpfs /tmp:size=16m \
  --cap-drop ALL --security-opt no-new-privileges \
  --user 65534:65534 \
  -v "$PWD/work:/work:ro" -w /work \
  python:3.12-slim timeout 10 python main.py

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Your container is perfectly hardened. Your agent has a working send_email tool. What has the sandbox bought you?Reveal
Protection of the host, and nothing else. The sandbox bounds the environment; the tool is an authorised channel that the sandbox is specifically configured to permit. An injected agent inside a perfect container still emails your data out, because you gave it a door and then locked the windows. Sandboxing and least privilege are orthogonal controls and neither substitutes for the other.
Q2When is a container insufficient, and what is the concrete decision rule?Reveal
Containers share the host kernel, so a kernel bug is a full escape. The rule: if the workload can be influenced by someone who is not the operator — a public product, user-submitted goals, agents reading the open web — you need a syscall or virtualisation boundary (gVisor, Kata, Firecracker) or a Wasm runtime. If goals only ever originate from your own team, a hardened container matches the threat model, which is accident rather than a funded attacker.

Please sign in to continue.

Questions people ask

Is a Docker container enough?

For most business applications, yes, when it is configured properly: no privileged mode, no host mounts, restricted network, read-only root filesystem where possible, and non-root user. For running genuinely untrusted code, use a VM or a purpose-built isolation runtime.

Should coding agents run in a sandbox?

Absolutely, and this is the single highest-value place to apply it. A coding agent reads attacker-writable text (issues, PRs, dependency docs) and executes commands. Sandbox it, and require explicit approval for network access and credential use.

How do I give the agent real data safely?

Give it a scoped copy, or better, a tool that answers questions about the data without handing the data over. "How many orders last week?" returns a number. It never needs the table.

Does sandboxing slow things down?

Container start-up costs a second or two, and you can keep warm pools. Compare that against a single incident. This is the cheapest insurance in the whole guide.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress