A coding agent running on your machine is not automatically confined to your project. A workspace path, approval prompt, or “sandbox” label is not enough to show what the agent can read, change, execute, or contact. A useful boundary is a configuration you can inspect: explicit filesystem permissions, network rules, credential exposure, process coverage, and a defined route for exceptions.
What a measurable boundary must specify
Describe the agent’s effective authority, not just where it starts. For a particular product and session, answer these questions:
As an Amazon Associate I earn from qualifying purchases.
- Filesystem: Which paths can it read, write, or not access? Is the project directory writable, and are home directories, caches, or other host paths exposed?
- Network: Is outbound access enabled? Can destinations be restricted? Can the agent reach local or private network services?
- Credentials and environment: Which environment variables, Git or API credentials, tool configurations, caches, and secrets can the process use?
- Processes and tools: Do the same limits cover shell commands and child processes, built-in file tools, MCP servers, language servers, and services launched independently?
- Exceptions: Does a blocked action fail, prompt for a narrowly scoped approval, or offer an unsandboxed retry? Who can enable that retry?
- Verification: Can you inspect the effective policy for the running session and confirm what it actually enforces?
These are separate controls. A filesystem restriction does not imply network restriction, and a workspace setting does not establish operating-system isolation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How local execution differs from an enforced sandbox
A process can run locally while retaining the host permissions of the account that launched it. The OpenAI Agents SDK documentation says its Unix-local backend on Linux adds no OS-level confinement: setting a workspace directory, HOME, or cwd does not restrict access the host otherwise permits. On macOS, the backend applies filesystem restrictions but does not provide network isolation or a container-equivalent boundary. The SDK recommends Docker, hosted execution, or external isolation for untrusted commands, with attention to permissions, mounts, credentials, and network access (OpenAI Agents SDK sandbox clients).
#1 Best Overall
Environment filtering is narrower than confinement. The SDK’s Unix-local client inherits the host process environment by default. Setting inherit_host_environment=False filters that inheritance, but the documentation explicitly says it does not add OS-level confinement. It can reduce which variables reach a process; it does not by itself stop access to host files or networks.
Example: what VS Code Agent Host settings expose
Microsoft’s Agent Host documentation, accessed October 7, 2026, describes defaults that illustrate why a product name or sandbox toggle is not a complete boundary description. In that documentation, sandboxing is off by default, outbound networking is allowed, local-network access is disabled, and allowed-domain, denied-domain, and user-configured filesystem path lists are empty. Requests to run unsandboxed are allowed by default. These are documented defaults for Agent Host, not universal settings for other products or versions (VS Code Agent Host sandboxing).
Rank #2
The filesystem and network policies are independent. The documented filesystem policy supports read-write, read-only, and denied paths; denied paths take precedence. A reader assessing a session should check both policies rather than infer one from the other.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCredentials and developer tools matter too
In the same documentation, developer-tool access defaults to enabled and can expose tool directories, configuration and caches—including registry tokens—and shared build caches. Git and GitHub authentication can also be passed to sandboxed processes by default settings. Those permissions can expand what an agent can do even when its file access appears limited to a workspace.
Check the effective policy
In VS Code, the documented /sandbox policy command reports whether restrictions are active and describes the effective filesystem and network policy. Checking the active session is more reliable than assuming that a setting name or interface mode corresponds to a particular restriction.
What a container changes—and what it does not
Docker’s tutorial describes a local workflow that gives an agent a private environment with its own operating system and Docker daemon. Installed tools and system changes stay in an environment that can be discarded. The tutorial lets users choose a default network policy and describes a Balanced policy that permits common development services while blocking other destinations by default (Docker: Run your coding agent in a sandbox).
The project directory remains an important exception: the tutorial shares it read-write, so the agent can modify or delete project files. The environment may be disposable, but those workspace changes are not. Docker advises keeping work under version control and reviewing changes with git diff. Before an agent runs, know which host paths are mounted and whether they are writable.
Recommended Free Tools
Approvals are not the same as confinement
Microsoft’s VS Code security documentation distinguishes approval controls from sandbox enforcement. Approval settings determine whether actions run automatically or require confirmation; sandboxing constrains what terminal commands and child processes can access. A confirmation prompt can help a person decide whether to permit an action, but it does not itself limit what an already permitted process can reach.
Best Value
The documentation also cautions that shell commands may run with the user’s permissions and credentials, and that auto-approval relies on best-effort command parsing with known limitations. Commands and tools can affect files, install software, call external APIs, change infrastructure, or deploy services. Non-process tools have separate permission checks; MCP and language-server processes are sandboxed only when the relevant settings apply. Microsoft characterizes sandboxing as “an added layer” and says it is not a virtual machine or user-account boundary, a standalone security boundary, or a replacement for endpoint security (VS Code security documentation).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare execution options by their actual boundaries
When weighing local processes, OS-level sandboxes, containers, or hosted execution, compare the controls that apply to the specific setup. The label alone does not establish the answer.
| What to compare | Questions to answer |
|---|---|
| Enforcement and isolation | Is the agent a host process, constrained by an OS-level sandbox, running in a container, or executing in a hosted environment? What mechanism enforces the restriction? |
| Filesystem scope | Which paths are readable, writable, or denied? Which host directories, caches, and workspace mounts are exposed? Can the project be changed or deleted? |
| Network scope | Is outbound access on? Can destinations be allowlisted or blocked? Can the agent reach private or local-network services? |
| Credentials and environment | Which variables, Git or API credentials, tool configurations, caches, and secrets reach the agent or its child processes? |
| Process coverage | Do limits cover shells and child processes, built-in tools, MCP servers, language servers, and independently launched services? |
| Exceptions | What happens when a restriction blocks an operation: failure, approval, or an unsandboxed retry? Who can authorize it? |
| Recreation and cleanup | Can the execution environment be recreated or discarded? Which changes persist in the host workspace? |
Why least privilege needs verification
A 2026 preprint introducing AuthBench evaluated 120 realistic terminal tasks and reported that frontier models could omit permissions required by an execution chain while also granting unused or sensitive access. The authors reported that more inference-time reasoning did not resolve the mismatch. This is a finding about the models and tasks studied, not proof that every agent or workload behaves the same way; it is a reason to verify permissions against the actual work rather than rely on an agent’s own assessment (AuthBench preprint).
For a specific agent and session, record the paths, network rules, credentials, covered processes, and exception behavior, then inspect the effective policy and observe how blocked actions behave. That turns “local” or “sandboxed” into a claim that can be checked against the configuration and its effects.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
