Controls
Agent sandboxing
definition
Agent sandboxing is the practice of running an AI agent inside an environment that restricts its filesystem, network, and process access, so that a compromised or misled agent cannot act beyond a defined boundary.
In depth
Sandboxing is the control that assumes the model will be fooled. Since prompt injection has no complete mitigation, the productive question is not whether the agent can be tricked into attempting something harmful but what happens when it does. A sandbox makes the answer 'nothing much'.
There are three boundaries worth setting, and they are not equally valuable. Filesystem — the agent sees the project directory and not `~/.ssh`, `~/.aws`, or the browser profile. Network egress — outbound connections restricted to an allowlist, which is the single highest-leverage control because it removes the destination every exfiltration needs. Process and privilege — no ambient cloud credentials, no host Docker socket, resource limits so a runaway loop is bounded.
Implementations range from OS-level primitives, such as macOS sandbox profiles and Linux namespaces or bubblewrap, through containers and dev containers, to disposable cloud VMs. Agent hosts increasingly ship their own sandbox modes; the practical difficulty is rarely the mechanism and almost always the calibration.
That calibration is the whole engineering problem. A sandbox tight enough to be meaningful breaks legitimate work — the agent cannot reach the internal package registry, cannot run the integration tests, cannot call the API it is supposed to be integrating. Engineers respond by disabling it, and a disabled sandbox is worse than a loose one because everyone believes it is on. Egress allowlisting plus a scoped credential usually buys more real safety than aggressive filesystem isolation, and costs far less goodwill.
Why it matters for governance
Sandboxing and supply-chain vetting are complements, not alternatives, and each covers the other's blind spot. Vetting stops the known-bad artifact from reaching the machine; the sandbox limits what the unknown-bad one accomplishes once it is there. A team with only vetting is one novel payload away from a bad day. A team with only a sandbox has no idea what its agents are running, and will find out during the incident.
Frequently asked
- Does sandboxing stop prompt injection?
- It stops injection from mattering, which is the achievable goal. The model can still be misled; a sandbox removes the file it would read and the host it would send to.
- What is the single most effective sandbox restriction?
- Network egress allowlisting. Almost every serious agent attack ends with data leaving the machine, and an allowlist removes the exit. It is also cheaper to maintain than fine-grained filesystem policy.
Sources
Primary sources for the claims on this page. Specifications and vendor documentation change — verify against the source if a detail is load-bearing for a decision you are making.