Sandboxing: isolating an AI agent to contain the risks
Sandboxing means running an AI agent inside a closed environment where its access to files, the network and system commands is restricted. If the agent makes a mistake or gets manipulated, the damage stays inside that space.
Data as of October 22, 2026
Key figures
| Level | Advanced |
|---|
The principle
An AI agent that runs commands acts with whatever rights it is given. On a user’s own machine, with no precautions, it could read passwords, change system files or send data outside. A sandbox draws a line: inside, the agent can do as it likes; beyond it, everything is blocked or needs permission.
Two barriers matter most:
- Filesystem isolation: the agent only sees and changes a defined working folder.
- Network isolation: it can only reach approved addresses.
In an October 2025 post on sandboxing Claude Code, Anthropic makes the point that both are required, and describes using operating-system mechanisms (bubblewrap on Linux, Seatbelt on macOS) to enforce them.
A concrete example
You ask an agentic coding tool to fix a bug. Inside its sandbox it can read and edit the project’s code, run the tests and install dependencies from an approved registry. It cannot open your home folder or contact an unknown server. If a file in the project hides an instruction telling it to send your access keys elsewhere, the prompt injection fails: outbound traffic is blocked.
Common techniques
Depending on the risk, isolation ranges from a simple restricted folder to a container, a lightweight virtual machine or a disposable remote computer. Agents that drive a graphical interface (computer use) often run in a dedicated virtual machine that is reset after each task.
Why it matters
Sandboxing shifts how control works. Instead of asking the user to approve every single action, which eventually wears them down until they click “yes” to everything, you set the limits once and let the agent work freely inside them. It complements guardrails and keeping a human in the loop for irreversible actions. To size up a task before handing it over, the Can I trust an agent with this? tool offers a simple checklist.
Common myths
- “My agent is reliable, so it doesn’t need isolation.” The risk also comes from the content it reads, not only from its own mistakes.
- “A container is always enough.” Without network restrictions and careful handling of secrets, a container can still leak.
Related terms
- Prompt injection · An attack that slips hidden instructions into text an AI reads, to make it ignore its original instructions or act against its user.
- Guardrails · Checks placed around an AI model to filter what goes in and what comes out, and to block unwanted answers or actions.
- Computer use · The ability of an AI model to operate a computer the way a person does: reading screenshots, moving the mouse, clicking and typing.
- Agentic coding · Software development in which an AI agent reads the codebase, edits files, runs tests and fixes its own mistakes over several steps, under supervision.
- Human-in-the-loop · A design where a person reviews, corrects or stops the important steps of an AI system or agent before they take effect.
Try it
Full glossary
Frequently asked questions
Does a sandbox make an agent completely safe?
No. It limits the consequences of a mistake or an attack, but the agent can still misuse what it is allowed to do, such as deleting files in its working folder. Pair it with guardrails, backups and human approval.
Why isolate the network and not just the files?
Because an agent that can read sensitive data and reach any server can send that data out. Anthropic stresses that effective sandboxing needs both filesystem isolation and network isolation.
Do consumer assistants use sandboxes?
When an assistant runs code to analyse a file or do a calculation, that code usually runs in an isolated environment on the provider's side. The exact arrangements vary between services and are not always documented publicly.
Does a read-only agent need a sandbox?
The risk is lower but not zero: a booby-trapped web page or document can push the agent to leak what it has read. Restricting outbound network access is still good practice whenever confidential data is involved.
Data sources
Data as of October 22, 2026
Report an error
Does a figure, a date or a fact look wrong? Tell us: every report is checked.