Glossary · Security and risks
Sandbox
A sandbox is an execution environment that restricts what a program can access or change beyond its assigned boundaries. For an AI agent, it can limit access to files, networks and computing resources, helping contain the consequences of commands and other operations it performs.
Sandbox: the explanation
A sandbox enforces restrictions on the program running inside it. It may hide particular folders, prevent changes or limit outbound connections. These boundaries need to be imposed by the environment rather than merely requested in a prompt. Depending on the setup, execution may use a restricted process, a container or a virtual machine. These techniques do not provide identical guarantees, so the actual configuration determines which protections apply to the task you are carrying out.
The environment lets you try or run operations within a controlled scope. A coding agent might execute a program against copied files without direct access to your everyday documents. An analysis tool might process an uploaded file there. The purpose is to separate certain effects from the rest of the system. You can then inspect the output before moving a changed file or other result into an environment used for your regular activities or live services.
A sandbox does not guarantee absolute isolation. Shared folders, available credentials and permitted network connections may provide routes to outside information or services. Broad settings can weaken the protection you expect. It is also useful to distinguish contained execution from exported results: a file produced inside the environment can still contain errors. You need to know which access is allowed, how results leave the environment and what happens to the supplied information after execution ends.
A concrete example
You want an agent to clean a contact spreadsheet. You supply a copy containing only the necessary columns inside an isolated environment, without access to your personal folder. The agent produces an updated file and a description of its changes. You compare the results before retrieving the output. Isolation limits effects on your computer, but you still need to check whether the proposed corrections make sense.
Why it matters
A sandbox matters when an agent runs code or handles files. Check accessible folders, allowed connections and resource limits. The label alone does not explain the protection provided. Working on copies, controlling exported results and removing the environment after use can help keep the scope appropriate to your task. These practical details matter more than assuming every isolated environment behaves in the same way.
Common misconceptions
- A sandbox does not automatically mean that Internet access is unavailable, because its network settings may allow the program to reach selected services or communicate more broadly, depending on the restrictions that were actually configured.
- Running a program in a sandbox does not make its output trustworthy, because restricting some effects does not establish that the calculations, generated files or conclusions supplied by the agent are accurate or suitable.
Related terms: security and risks
- guardrails
- Guardrails are measures that constrain how an AI system behaves and which actions it can perform.
- least privilege
- Least privilege is a security principle that gives a system only the access needed for its assigned task.
- prompt injection
- Prompt injection is an attempt to redirect an AI system through instructions placed in material it processes.
- API key
- An API key is an identifier that software sends when accessing certain online services.
- OAuth
- OAuth is an authorization framework that lets an application obtain limited access to another service.
Where this site covers it
The term appears on 713 pages of this site. A few of them:
- Codex CLI reference guide: installation, approvals, sandboxing, AGENTS.md, and costs Guide
- Securing an AI agent: permissions, secrets, sandboxing, human approval, and logging Guide
- Program synthesis: principles, history, and a possible path to AGI Guide
- Hosting an AI agent on a VPS: server selection, installation, security, backups, and costs Guide
- Run an AI agent in a sandbox Article
- AI agent security: 10 risks and how to protect against them Article
- Malicious MCP servers and skills: check before installing Article
- AI agents and the GDPR: what data leaves, and where does it go? Article
Go further
Frequently asked questions
Is it always a virtual machine?
No. Different techniques can restrict a program, with different isolation properties. A virtual machine is one option, but sandbox mainly describes a bounded execution environment and the restrictions enforced around the program running there.
Can it still access your files?
It should only access files exposed through its configuration. A shared folder can make its contents available to the program. Check the allowed locations and whether the associated permissions permit reading, changing or deleting files.
Can you retrieve the results?
Yes, when the environment provides an export mechanism. It is useful to select and inspect the files you retrieve, because being created inside an isolated environment does not guarantee their accuracy, safety or suitability.
Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score