Yes—but access depends on the agent’s runtime, mounts, tools and permissions. A sandbox may intentionally share a project folder with an agent, while a shared environment or custom tool can expose additional files or credentials. That does not automatically mean the agent escaped isolation. Check the active configuration and the specific path before treating access as a breach.
What “outside the sandbox” can mean
“Sandbox” is not a universal boundary. One setup may give an agent no host workspace, another may deliberately mount a host project, and a third may let the agent read a repository while keeping its edits separate. The relevant question is which files and tools the particular runtime exposes.
As an Amazon Associate I earn from qualifying purchases.
For example, Docker documents three local sandbox modes with different workspace behavior:
Recommended Free Tools
| Mode | Host workspace visibility | Effect on host files |
|---|---|---|
| Mountless | No host workspace is shared. | The agent works in its own filesystem rather than the host project. |
| Direct mount | The mounted working tree is shared. | It is read-write, so agent changes affect the host files. |
| Clone | Repository contents are readable through a private clone. | Edits stay in the clone until fetched; the host repository is mounted read-only. Untracked files and files excluded by .gitignore may still be readable. |
These are Docker-specific modes, not a description of every agent product. See Docker’s filesystem mode documentation and its security guidance.
#1 Best Overall
Common causes of unexpected access
A workspace was intentionally mounted
A direct read-write mount lets the agent and host see the same working tree. That is expected sharing, not by itself evidence of a sandbox escape. Confirm whether the project directory was mounted and which mode is active.
Other agents or tools share the environment
OpenAI warns that agents sharing an environment can access the same files, credentials and other resources. Anthropic says custom tools and MCP servers running inside its managed sandbox inherit worker permissions, so the tool may have access that the agent process’s own restrictions do not make obvious. Review shared workers and tools separately from the sandboxed process. See OpenAI’s self-hosted agent guidance and Anthropic’s managed-agent documentation.
A hard link points to the same underlying file
A hard link is another directory entry for the same file data. Docker notes that its filesystem policy evaluates the workspace path, so a hard-linked file reachable through that path can expose or modify the underlying file even if another path to it is outside the workspace. Check the requested path and its filesystem relationships rather than relying only on the path’s apparent location.
Free tools Windows power users keep installed
One-click scans. No signup required.
Configuration or files were expected to be imported
Limited visibility can be mistaken for a problem in the opposite direction: a sandbox may not include all host user-level configuration. Docker says local sandboxes do not import the complete user-level configuration, such as ~/.codex or ~/.claude, while project-level configuration remains available. Its FAQ also says a symlink to an unmounted host path cannot be followed from the sandbox. See Docker’s sandbox FAQ.
Rank #3
The launch template or permission mode is different than expected
Verify the actual launch command and effective policy; product names alone do not establish which restrictions are active. Docker’s Codex sandbox template guide says that template’s default startup command is codex --dangerously-bypass-approvals-and-sandbox. This is specific to that Docker template and should not be generalized to other Codex installations. Check the template’s current setup documentation.
Read-only access was mistaken for confidentiality
A read-only repository can still reveal its contents. Docker’s clone mode separates writes from the host checkout but does not hide repository files. If a secret is stored in the workspace, read-only access does not protect it.
How to diagnose and fix access
- Identify the exact runtime. Record the agent product, local or cloud mode, and sandbox implementation. The word “sandbox” alone does not identify the boundary.
- Inspect the effective launch and permission settings. Check the command that actually starts the agent and the policy active for that process, including whether a template changes defaults.
- Inventory mounts and shared resources. Determine which directories are mounted, whether they are read-write, and whether other agents share the same environment.
- Inspect the path itself. Check for hard links, symlinks, and any product-specific path mapping that could account for access—or explain why an expected file is unavailable.
- Review tools and credentials. List custom tools, MCP servers, worker permissions and credentials the agent can use. Restrict these independently where needed.
- Choose isolation to match the task. Use a mountless environment if the agent should not see host workspace files. If it needs repository context but must not edit the host checkout, clone mode can separate writes, but it still exposes repository contents.
- Move secrets out of visible workspaces and scope credentials. OpenAI says to keep the application API key outside the sandbox and give the environment key only the permissions needed to connect environments. Do not treat a read-only mount as secret protection. See OpenAI’s guidance.
What stronger sandboxing can and cannot establish
Anthropic describes filesystem and network isolation as complementary controls: filesystem restrictions limit access to sensitive files, while network restrictions can help prevent exfiltration. Its guidance says operating-system-level controls cover scripts and subprocesses spawned by commands, and that allowed paths and network domains can be configured. This is the vendor’s security position, not proof that every agent product uses the same controls. Read Anthropic’s explanation of sandboxing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In an October 20, 2025 engineering post, Anthropic reported that, in its internal usage, sandboxing “safely reduces permission prompts by 84%.” That is an Anthropic internal result, not an independent or universal rate for AI agents. The sources cited here do not establish a general sandbox-escape rate or prove that a particular setup has been breached.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
