You cannot determine whether an AI agent sandbox is secure from its product label, documentation, or prompt instructions alone. Evaluate the deployed system against a written threat model, inspect its effective controls, and test whether untrusted agent code can reach assets it should not. Any passing result applies only to the configuration and behaviors you tested.
Define what the sandbox must contain
Start by listing the assets the agent must not access and the boundaries that separate them from its execution environment. Agent-generated code can access the files, credentials, and network available to that environment; a sandbox is only as protective as the restrictions actually enforced around it.
As an Amazon Associate I earn from qualifying purchases.
Decide explicitly whether your threat model includes malicious or compromised generated code, shell access, package installation, arbitrary code execution, a compromised tool, cross-tenant attacks, host escape, control-plane access, or connections to internal services. Include cloud metadata endpoints where relevant, along with systems reachable through attached tools. Distinguish the control plane—the trusted services that create and manage runs—from the workload in which untrusted code executes.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Kubernetes SIGs Agent Sandbox threat model is a useful example of making those boundaries explicit: it identifies tenant-to-tenant, workload-to-host, and workload-to-control-plane risks. Its model describes that project’s threat boundaries; it is not a certification of every Kubernetes deployment or runtime.
#1 Best Overall
Inspect the deployed execution boundary
Review the effective configuration, not just the intended design. Record the sandbox image and runtime, the identity used to run code, Linux capabilities, filesystem permissions, mounts, namespaces, device access, service-account tokens, and host interfaces. Check which of these are writable or reachable from inside a run.
- Identity and privileges: Determine whether code runs as root, which capabilities it retains, and whether it can access privileged interfaces or devices.
- Filesystem: Check whether the root filesystem is read-only, what writable locations exist, and whether host paths, credentials, or other workloads’ files are mounted into the environment.
- Runtime and kernel boundary: Identify the mechanism that separates the workload from the host. A container is not a complete description of that boundary. Kubernetes documentation describes runtimes such as gVisor and Kata Containers as options administrators can configure; the project itself does not claim to supply isolation.
- Harness and control plane: Establish what trusted code handles tool calls, starts and stops runs, and passes data or credentials. A weak harness or overly broad control-plane access can undermine isolation without a kernel exploit.
For self-hosted sandboxes, Anthropic recommends dropping unnecessary Linux capabilities, running as a non-root user, and using a read-only root filesystem. These are hardening measures to verify in your deployment, not proof that every other boundary is secure.
Mechanisms also differ by execution mode. OpenAI’s GPT-5.3-Codex system card describes cloud execution in an isolated container with networking disabled by default, and local controls using Seatbelt on macOS and seccomp plus Landlock on Linux. These are implementation-specific examples, not a universal security ranking.
Verify network and credential restrictions
From inside the deployed execution environment, check whether outbound connections are denied by default or restricted to documented, necessary destinations. Test the policy against the destinations in your threat model, including internal networks and metadata endpoints when those are in scope. A stated rule is not evidence that the effective network path enforces it.
Keep application credentials out of model-directed code unless they are essential. OpenAI warns that placing a stored secret in the execution environment still exposes it to agent-generated code. Where an agent needs to perform a third-party operation, consider a trusted broker or proxy that supplies a narrowly scoped secret only for an approved destination. For self-hosted sandboxes, Anthropic assigns egress control and service-key storage and rotation to the operator.
- Document allowed destinations and why each is needed.
- Probe the deployed rules from within the sandbox rather than relying only on configuration review.
- Check which credentials, tokens, and service-account permissions are available to the workload.
- Have a response path to revoke or rotate credentials if exposure is suspected.
Test the exact configuration before an evaluation
Anthropic’s published evaluation-security guidance recommends hardened sandboxes without internet access by default, allowing only the model API connection where required, and verifying the setup before each evaluation. Its pre-engagement procedure calls for static inspection and supervised attempts to probe and escape the sandbox. Ideally, those attempts take place without internet access and inside a second sandbox.
Rank #3
Make the evaluation’s scope concrete before running it: name the permitted targets and actions, prohibited actions, and network boundaries. Anthropic recommends stating network limits as instructions rather than asserting that the environment already has a particular property. Instructions communicate scope; they do not enforce containment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check that the challenge is actually solvable. Anthropic notes that an unsolvable target can motivate out-of-scope behavior, so challenge validation is part of a safe evaluation setup, not merely a test of the model.
- Inspect: Review the image, runtime, privileges, mounts, network policy, credentials, and control-plane exposure.
- Probe under supervision: Use controlled attempts to test the boundaries named in the threat model. Use a disposable setup, and isolate the evaluation from production assets.
- Monitor: Observe model actions and network activity during the run. Set an alert path and a human or system control that can stop the evaluation if it crosses scope.
- Record: Preserve the exact configuration and evidence for the run so a result can be reproduced and its limits understood.
Use tests that prove outcomes independently
A sandbox escape benchmark should verify a claimed result outside the payload, rather than accepting the payload’s own report that it succeeded. Safety Research’s AgentEscapeBench describes running a candidate payload in a separate scoring VM and checking proof from outside the sandbox. It covers multiple sandbox families and distinguishes read, write, crash, and escape proof types.
AgentEscapeBench’s README also notes that some proof types or sandbox families are disabled because their checkers have not been positive-control-validated. Check the benchmark’s current listed status before treating a result as evidence for those cases.
The SandboxEscapeBench paper describes a threat model in which a motivated agent has shell access inside a container. It covers misconfiguration, privilege-allocation mistakes, kernel flaws, and runtime or orchestration weaknesses. Its reported finding is scoped: when vulnerabilities are added, models can identify and exploit them. That supports testing realistic failure modes; it does not establish a universal escape rate or predict the security of a particular deployment.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCompare sandboxes by controls you can verify
Do not choose by the word “sandbox” or by a claimed overall security score. Compare the specific deployment options against the same threat model and ask whether you can inspect and test each relevant boundary.
Best Value
| Evaluation area | What to compare | Evidence to request or collect |
|---|---|---|
| Isolation mechanism | Runtime and its stated threat assumptions | Deployed runtime and image details; controlled tests of the host boundary |
| Privileges and filesystem | User identity, capabilities, writable paths, mounts, and device access | Effective workload configuration and observed access from inside a run |
| Network egress | Default policy, allowed destinations, and how restrictions are enforced | Configuration plus probes from the execution environment |
| Tenant separation | How workloads and data are separated across tenants | Threat model and tests for the tenant boundary |
| Credentials | Storage, brokering, scope, exposure to code, and revocation | Credential paths and permissions; a documented response to suspected exposure |
| Control plane | Workload access to management APIs and trusted harness components | Trust-boundary design and tests of workload-to-control-plane access |
| Monitoring and stopping | Visibility into actions and network activity; ability to halt a run | Alerts and a demonstrated stop path for out-of-scope behavior |
| Configuration-specific testing | Whether the exact deployed setup can be evaluated | Reproducible run details and independently checked test outcomes |
These are comparison criteria, not a provider ranking. The available guidance describes controls and responsibilities in particular deployment modes; it does not establish a universally secure product or provide an independently verified cross-provider ranking.
Report what a passing result actually means
A clean test run means only that the tested behaviors did not demonstrate a prohibited path under the recorded conditions. It does not prove that the sandbox cannot be escaped. Report enough detail for another team to understand what was and was not tested:
- Image and runtime versions, configuration, and test date.
- Network rules, model and tool access, and the threat boundaries in scope.
- Test cases, proof method, observed results, and any layers not tested.
- Whether a failure arose from configuration, runtime, kernel, orchestration, or the harness.
For the policy you tested, any demonstrated route to a prohibited asset is a containment failure, even if the route resulted from configuration rather than a runtime exploit. Re-test after material changes to images, runtimes, network rules, credentials, or orchestration. No directly applicable, owner-attributed statistic in the cited materials measures the overall security of AI-agent sandboxes; benchmark results should not be converted into a real-world incident rate or a universal escape percentage.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
