Sandbox

What is a sandbox?

A sandbox is an isolated execution environment that restricts what code or tools can access, modify, or communicate with. In AI-agent systems, sandboxes are commonly used when a model can run generated code, shell commands, browser actions, or other potentially risky operations.

Isolation reduces the blast radius of mistakes and malicious inputs. A sandbox may limit files, processes, network destinations, credentials, compute resources, execution time, and persistence.

How it works

Sandboxing can be implemented with operating-system processes, containers, virtual machines, microVMs, browser isolation, or purpose-built execution services. The technology matters less than the enforced boundary and threat model.

A useful sandbox starts with minimal access. The system selectively mounts files, provides temporary credentials, limits outbound connections, caps CPU and memory, records activity, and destroys or resets the environment after use.

Simple example

A coding agent needs to test user-provided Python. The system runs it in a temporary environment with no production credentials, a read-only input directory, a writable temporary folder, restricted network access, and a 30-second execution limit. If the code loops forever or attempts to read private files, the sandbox contains the effect.

Sandbox versus tool permission

A [tool permission](/glossary/tool-permission/) decides whether an operation is authorized. A sandbox limits what the execution environment can actually reach or affect.

Permissions might allow a “run tests” tool. The sandbox ensures that the test process cannot read unrelated secrets or contact arbitrary services. Neither control fully replaces the other.

Limits

A sandbox is not automatically safe. Misconfiguration, overly broad mounts, accessible credentials, network egress, vulnerable isolation technology, or shared caches can weaken the boundary. A sandbox also does not determine whether an authorized business action is appropriate.

For example, isolated code may still generate harmful content, and a correctly sandboxed browser can still submit an unwanted form if granted that capability.

Why it matters

Agents can produce unexpected commands even without an attacker. Sandboxing turns some failures from system-wide incidents into contained, observable errors.

It works best as one layer alongside prompt-injection defenses, permissions, input validation, timeouts, and human approval. See [Tool Use in AI Agents](/tool-use-in-ai-agents/) for how execution fits the wider agent loop.