What is Sandbox?
An isolated environment in which an agent runs code without reaching anything it wasn’t given.
Isolation limits what a mistaken or manipulated agent can touch.
On this page
A sandbox is an isolated environment — a container, a virtual machine, a dedicated machine — in which an AI agent runs code without reaching anything it was not explicitly given: not the host machine's files, not the network at large, not the credentials kept outside. The sandbox is the boundary that makes autonomy affordable, because it converts the question "can we trust this agent?" into the manageable question "what did we put inside the walls?"
The distinction that matters is what the sandbox bounds: the blast radius. An agent that misunderstands a task, follows injected instructions hidden in a dependency, or simply writes bad code will do so inside the sandbox — and the worst outcome is a wrong branch in a container, not a damaged machine or a deleted database.
What a sandbox actually restricts
| Restriction | What it stops | Typical implementation |
|---|---|---|
| Filesystem scope | Reading credentials, dotfiles, unrelated projects; writing outside the workspace | Mount only the repository and designated outputs |
| Network egress | Exfiltration to arbitrary endpoints; calls to production services; surprise downloads | Deny by default, allowlist what the task needs |
| Process and secrets isolation | The agent reaching the host OS or env vars with keys | Container or VM boundary; credentials injected just-in-time or proxied |
| Write scope | Pushes to protected branches, direct edits to shared state | Branch-only write access; merges happen through review |
Network control deserves its own emphasis, because it is the difference between a mistake and an incident. Simon Willison's lethal trifecta — private data plus untrusted content plus an outbound channel — is broken precisely by cutting the channel: an agent that cannot reach the internet cannot exfiltrate what it read, however thoroughly it was manipulated.
What a sandbox does not protect
Isolation is one layer of guardrails, not all of them. A perfectly sandboxed agent can still:
- call an external API with credentials that were placed inside the sandbox;
- push bad-but-syntactically-fine code that passes no review;
- approve its own work, if the platform lets agent state transitions stand;
- burn tokens in a retry loop nobody is watching.
Each of those needs a different control — secrets kept out of reach entirely, independent review of every change, server-side state enforcement, retry caps with escalation. The sandbox makes the agent's reach safe; it says nothing about the judgement of what it does within reach.
Sandbox defaults across the major tools
The vendors' own documentation shows the pattern converging:
| Tool | Default environment | Notable restriction |
|---|---|---|
| GitHub Copilot coding agent | Isolated cloud container | Network firewall on by default; human approval before Actions workflows run on its PRs |
| OpenAI Codex | Cloud sandbox per task | read-only, workspace-write, danger-full-access modes; network disabled in restricted modes |
| Claude Code | Local execution with sandboxing; cloud sessions in isolated VMs | Tiered permission rules; explicit approval prompts for commands and external fetches |
Two things are consistent across all three: isolation is the default, not an opt-in; and network access is the first thing restricted. That convergence is the field's answer to the incidents of 2025 — treat the unattended agent's environment as hostile by default.
Best practices for sandboxing agents
1. Default to deny, allowlist the task
Filesystem, network, and credentials all start closed. Open only what the specific work needs — an agent writing tests rarely needs the network at all.
2. Keep secrets out rather than hidden
A secret inside the sandbox is a secret the agent can read, and anything readable can leave. Short-lived, scoped tokens where external access is unavoidable; nothing where it is not.
3. Never let the sandbox reach production shape
No production databases mounted, no production credentials, no shared infrastructure. The environments an agent works in should be as disposable as the mistakes it will make in them.
4. Pair the sandbox with review
The sandbox bounds where damage can happen; review is what catches the damage that stays inside. Both are needed — isolation without review just produces confident, contained wrongness.
5. Log what the sandbox contained
When an incident does happen, the first question is "what could it reach?" The sandbox configuration — mounts, allowlists, token scopes — should be part of the audit record, not tribal knowledge.
Sandbox in YATFA
Agents in YATFA work on their own machines and containers, on dedicated branches, with credentials and environments they were given — never the ones that matter elsewhere. Combined with review by an agent that did not write the change and server-side enforcement of approvals, the worst case of a hijacked or mistaken run is a reviewable branch with a log. The isolation model is described on trust, and the full guardrails design in guardrails for AI coding agents.
Frequently asked questions
Is a Docker container a sandbox?
It is the common implementation, with caveats. Containers isolate filesystem and processes well, but a container with network access and credentials inside is not a boundary against exfiltration or API misuse — it is a tidy room with the door open. Sandbox-grade isolation means deny-by-default network and secrets kept outside.
Do agents always need a sandbox?
Any agent that executes code or touches a repository should run isolated — the cost is minutes of configuration and the alternative is bounded only by trust in a probabilistic system. Read-only conversational use with no tools is the only case where the question does not arise.
What is the difference between a sandbox and an approval gate?
The sandbox bounds what the agent can do; the gate bounds what it may do without a person. They answer different failures — accidents and manipulation versus judgement calls about consequences — and mature setups use both: isolation everywhere, human gates where blast radius or intent demands it.