To sandbox an AI agent safely in production, isolate the compute where it runs model-directed commands and file operations, deny unnecessary network access, keep sensitive credentials outside that environment, and enforce approvals and audit in a trusted harness. A sandbox limits execution; it does not replace the surrounding security design.
What does an AI agent sandbox protect?
An agent sandbox is an execution boundary around work such as running commands, changing files, or installing packages. Its value depends on what the boundary actually enforces—not on the word “sandbox” in a product name or on instructions asking the agent to behave safely.
As an Amazon Associate I earn from qualifying purchases.
Separate the system into two planes:
- Trusted harness: owns the agent loop, model calls, tool routing, run state, approvals, tracing, and recovery.
- Execution environment: performs model-directed filesystem and command work.
Keeping control-plane functions in trusted infrastructure limits the authority inside the environment where generated code runs. A workspace alone is not proof of isolation: if a process can reach the host, other users’ data, or a sensitive service, workspace conventions do not stop it.
Recommended Free Tools
OpenAI’s Agents SDK documentation makes an important distinction: its Unix-local Linux backend runs host processes without OS-level confinement, and its macOS implementation’s filesystem restrictions do not provide network isolation. Treat those local modes accordingly; for commands influenced by untrusted input, use configured Docker, hosted compute, or another external isolation layer.
#1 Best Overall
How should you define the boundary before choosing a sandbox?
Start with the work the agent must do and the consequences you need to contain. Write down the files and data it needs, the commands and tools it may use, the services it must contact, and the actions that need human review.
- Identify sensitive host paths, application data, credentials, and metadata services that must remain inaccessible.
- Specify which workspace paths are visible and writable, whether files persist after a run, and how state is separated among users and workloads.
- List required tools and external destinations, including where each connection originates.
- Mark consequential actions—such as changing production data or invoking privileged services—that require a separate approval or trusted service.
Use distinct environments when users or workloads must not share data. Mount only the paths required for a task rather than broad host directories. Make persistence deliberate: temporary work, retained artifacts, and user-specific state should not be left to accidental defaults.
Which execution model fits the threat?
Compare the actual boundary and operational responsibilities, not just the label. The primary documentation discussed here does not establish a universal ranking for safety or speed; select against your threat model and verify the exact configuration you deploy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Execution model | What the documentation establishes | What to verify |
|---|---|---|
| Local process backend | The Agents SDK’s Unix-local Linux backend adds no OS-level confinement. Its macOS filesystem restrictions do not isolate networking. | Whether processes can access host files, credentials, network routes, or other users’ data. Do not treat workspace restrictions as a complete security boundary. |
| Configured Docker or other external isolation | The SDK guidance identifies configured Docker or external isolation as options for untrusted commands; a container’s presence alone does not define its protections. | Filesystem mounts, runtime privileges, resource limits, network routes, credentials, persistence, and the wrapper’s startup flags and command. |
| Hosted sandbox compute | Hosted compute is an option for separating execution from the harness; the reviewed material does not provide a common benchmark or universal guarantee across providers. | Provider-specific isolation, region and data handling, egress controls, state separation, secret flow, operational ownership, and recovery behavior. |
| Reference design using gVisor and a proxy | An Anthropic reference harness combines gVisor for a syscall/filesystem boundary with Docker networking and an allowlist proxy for egress. | Runtime and host support, allowlist maintenance, resource limits, proxy policy, and whether the reference’s behavior matches your deployment. |
That last row describes one implementation, not a guarantee for every deployment using those components. Likewise, verify whether a hosted product runs the harness as well as the worker or only supplies isolated compute; those arrangements place control and identity in different places.
How do you restrict network access and credentials?
Assume code inside the environment can read whatever files and credentials are available to it, and can use whatever network paths it can reach. OpenAI’s sandbox security documentation states this risk directly: “Agent-generated code can access the files, credentials, and network available to its environment.” A narrow credential may still be exposed if sandbox code can read it.
- Start with outbound traffic denied. Allow only the destinations required by the workflow rather than giving the worker general internet access.
- Map connection origins. An executor-side tool may connect from your infrastructure, while a remote tool endpoint may need to be reachable from the remote service. Apply policy at the point where the connection actually originates.
- Keep application keys out of the worker. Store long-lived credentials in a secrets manager or trusted application layer, not in workspace files or broad environment variables visible to generated code.
- Broker narrowly scoped access. Use a trusted proxy or function tool to perform approved requests with scoped credentials. If an executor key is necessary to connect a sandbox, restrict it to that role and treat it as readable by the sandbox.
- Test denied routes. Confirm that prohibited destinations, including metadata endpoints and secret-bearing services, cannot be reached from inside the workload.
A published reference configuration illustrates why egress rules need operational review: its default proxy permits an Anthropic API endpoint, while other providers require an explicit egress list. The same reference notes that changing proxy configuration can interrupt running connections. These are configuration-specific details, not universal defaults; check the active policy and the impact of changes in your own system.
Where should approvals, policy, and audit live?
Keep approval policy in the trusted harness or another control plane that the execution environment cannot rewrite. The sandbox defines the technical boundary; policy determines which actions that boundary permits and which actions must stop for review. A worker should not be able to grant itself approval or alter the rules governing its own run.
OpenAI’s account of its Codex deployment describes this separation between sandboxing and approval policy. For a production system, decide explicitly which tool calls or effects need approval, who can approve them, and what happens when approval is unavailable or denied. Preserve that decision outside the worker’s writable workspace.
Collect enough context to reconstruct both what happened and how it was authorized:
- Prompt and run identity, with appropriate protections for sensitive content.
- Tool requests, approval decisions, execution results, and MCP usage.
- Network proxy allow and deny events.
- Run lifecycle events, including failures, retries, and recovery actions.
Conventional process and network logs help establish activity. Agent-aware events add the tool, approval, and policy context needed to interpret it. Restrict access to logs and set retention deliberately; observability should not become an unreviewed repository of secrets or sensitive prompts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you verify the deployed setup?
Test the running workload and its wrapper, not just a design diagram or a configuration file. Use a non-production environment and representative tasks to check these failure modes:
- Filesystem: confirm the worker sees only intended paths, cannot write protected paths, and cannot access another user’s workspace.
- Network: confirm required destinations work and denied destinations remain unreachable, including metadata and secret services.
- Credentials: inspect files, environment, mounts, and tool responses visible to the worker; verify broad application keys are absent.
- State: test whether temporary files are discarded as expected, retained artifacts are intentional, and state does not cross user or workload boundaries.
- Approvals: verify that a sensitive action pauses for the intended reviewer and that rejection or timeout does not silently proceed.
- Observability: confirm that tool outcomes and network decisions can be correlated to a run without exposing secrets unnecessarily.
- Resource and recovery behavior: set and test limits for execution, storage, and runaway work, then verify how interrupted or failed runs are cleaned up or resumed.
Inspect startup commands and wrapper flags with special care. Docker’s documentation for its local Codex sandbox wrapper describes a default startup command that bypasses approvals and sandboxing. Do not assume a wrapper preserves an agent’s safety controls: verify the effective command, mounts, flags, and network policy at launch. Product behavior can change, so check the documentation and settings for the exact version and deployment mode in use.
What should a production readiness review cover?
Before enabling real workloads, have the system owner answer these questions with evidence from the deployed configuration:
Quick Recap
- Is the harness outside the execution boundary, and can the worker alter its approvals or run state?
- Does the chosen runtime enforce the filesystem, process, and host-resource boundary required by the threat model?
- Is outbound access denied except for a documented set of destinations, with connection origin accounted for?
- Are application secrets kept outside the worker, with any necessary access brokered and scoped?
- Are workspaces, persistence, and user separation explicit and tested?
- Can operators trace prompts, tool decisions, results, and network events while protecting sensitive log content?
- Have the actual startup command, wrapper behavior, and recovery path been verified rather than assumed?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
