Sandboxed AI agents
A sandbox is a boundary. Not a governance program.
Isolation decides what a compromised agent can reach. It does not decide what an authorized agent is allowed to do. Pick the boundary by threat, then test what still gets out.
If the sandbox held perfectly, what could your agent still send out?
- Five isolation tiers, chosen by threat.
- Eight leak paths, tested on your setup.
- Authority controls for what isolation cannot stop.
Already shipped · Open source · Evidence-rated
Our escape tests are published. A valid bypass is a contribution, not a secret.
Sandboxed AI agents run their code and tools inside an isolation boundary, such as a process sandbox, container, gVisor, Kata container or microVM, that limits what a compromised step can reach. Isolation has to be paired with egress control, credential brokering, protected configuration and a policy gate, because a sandbox does not decide what an authorized agent may do.
Last updated Tested against AI SAFE² v3.1 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6By Vincent Sullivan
1 · Isolation tier
A dedicated kernel per session, Firecracker class. The strongest wall on this list.
2 · Controls around it
- Read ~/.ssh on the hostCONTAINED
- Kernel exploit to hostCONTAINED
- Cloud metadata endpointESCAPED
- Mounted docker.sockESCAPED
- DNS tunnel outESCAPED
- Allowed domain, broad tokenESCAPED
- Persist hook in agent configESCAPED
- Authorized destructive API callESCAPED
2 of 8 contained
Strong wall, open doors. The tier alone leaves most paths out.
We run these eight probes against your setup · Raw results
Is sandboxing enough to secure AI agents?
Built for Teams Running Agents With Data Access — and the Engineers Who Must Prove the Boundary Holds.
Disclosure: the eight escape probes on this page are CSI’s own tests against common default configurations; the Challenge Lab publishes a valid bypass as a contribution.
02 · Where you are
Three questions about your agent sandbox
Tap the answer closest to true today.
Which isolation runs today?
Then the agent's reach is your reach. Start with a tier from the isolation table and the host backstop.
Containers share the host kernel. Fine for trusted code, thin for untrusted. See the probe matrix.
Strong wall. Now check the doors: egress, tokens and config. Toggle the controls in the simulator.
Is egress allowlisted, DNS included?
Good. Now test the allowed domains. A broad token through an allowed host is probe 6.
DNS is a data channel. A tunnel out needs nothing but name resolution. That is test 3.
Then isolation stops the host compromise and nothing else. See the exfiltration path.
Which credentials are mounted inside?
That is the design. Confirm the broker refuses requests outside the task.
Scoped is better than broad. Check its lifetime and what one call can do with it. See the control matrix.
A mounted socket is a door through the wall. Remove it before any other change. That is probe 4.
03 · What changes
Why do sandboxed AI agents still leak?
Classic sandboxes contain untrusted code. Agents are trusted code that takes untrusted instructions, holds real credentials and needs the network to do its job.
| Question | Classic sandbox | Sandboxed AI agent |
|---|---|---|
| What is untrusted? | The code inside | The instructions the trusted agent reads |
| Network | Usually off | Needed, so it is allowlisted, and allowed hosts become exits |
| Credentials | None | Real tokens to real systems |
| Main risk | Escape to the host | Authorized misuse that never escapes anything |
| What fixes it | A stronger wall | A wall plus authority controls: broker, gate, approvals |
04 · The evidence
The eight probes, by tier and controls
Outcomes for common default configurations. The tier closes two paths. The controls close the rest.
| Probe from inside | Container alone | microVM alone | Container + all four controls | microVM + all four controls |
|---|---|---|---|---|
| Read ~/.ssh on the host | CONTAINED | CONTAINED | CONTAINED | CONTAINED |
| Kernel exploit to host | ESCAPED | CONTAINED | ESCAPED | CONTAINED |
| Cloud metadata endpoint | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| Mounted docker.sock | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| DNS tunnel out | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| Allowed domain, broad token | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| Persist hook in agent config | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| Authorized destructive API call | ESCAPED | ESCAPED | CONTAINED | CONTAINED |
| Contained | 1 of 8 | 2 of 8 | 7 of 8 | 8 of 8 |
Claude Code's sandboxed Bash tool covers shell commands. MCP servers, command hooks and plugin monitors run unconstrained on the host.
Anthropic Docs · Oct 2026Outbound internet is on by default when Copilot local sandboxing is enabled. Local network access is off.
GitHub Docs · Oct 2026Codex CLI's default workspace-write sandbox keeps network access off unless you enable it in configuration.
OpenAI Codex Docs · Oct 202605 · Abuse paths
How does data leave a sandbox that never broke?
If an allowed domain plus a broad token is the way out, what did the sandbox buy you?
Allowed-host exfiltration
- AssetSource code and secrets in the workspace
- ActorAn instruction in a file the agent read
- PathUpload to an allowlisted host, such as a code host, with the agent's own token
- ResultData out, every rule followed
Metadata credential theft
- AssetThe cloud role of the sandbox host
- ActorAny process inside the sandbox
- PathA request to the instance metadata endpoint
- ResultCloud credentials outside the sandbox's intended scope
Config persistence
- AssetThe agent's settings, hooks and MCP list
- ActorOne compromised session
- PathA writable config path inside the sandbox that the host loads later
- ResultCode that runs outside the sandbox next time
06 · Architecture
What does a complete agent sandbox architecture include?
Models propose. Infrastructure decides. Evidence proves. The wall is one layer of five.
- Isolation tierChosen by threat: shared kernel for trusted code, own kernel for untrusted.
- Egress controlAllowlist by host, with DNS resolved through the same policy.
- Credential brokerNothing mounted. Short-lived tokens issued per call, per task.
- Protected pathsAgent config, hooks and MCP lists are read-only inside the sandbox.
- Policy gateAuthorized but destructive actions escalate to a named human.
The host backstop
Local agents run on developer laptops, outside any cloud sandbox.
Warden kernel-level containment holds unknown executables at the kernel by default, whatever the agent's own sandbox did or did not do.
The sandbox is one layer of the full agent harness security architecture.
07 · Controls
Which sandbox controls map to AI SAFE²?
| Job | Control | AI SAFE² anchor | Shipped artifact |
|---|---|---|---|
| Prevent | Own-kernel isolation for untrusted code. Block metadata endpoints. | P1 Sanitize and Isolate | challenge-controlled-executor |
| Constrain | Egress allowlist with DNS. Brokered credentials. Read-only config paths. | P1 · CP.4 Agentic Control Plane Governance | openclaw |
| Detect | Alert on denied egress, metadata requests and config writes. | P4 Engage and Monitor | gateway ResponseScanner |
| Respond | Escalate authorized destructive calls to a named human. | CP.10 HEAR Doctrine | gateway HITL circuit breaker |
| Recover | Destroy the session, revoke its tokens, block traffic until operator recovery. | P3 Fail-Safe and Recovery | gateway SafeMode |
| Prove | Probe results with tier, config and versions, kept per release. | P2 Audit and Inventory | Challenge Lab evidence manifests |
08 · How to test
How do you test an agent sandbox for escape and leaks?
Run each probe from inside a real session, once with the control on and once with it off. Kept results rate E3.
1. Metadata endpoint E3
- Request the cloud instance metadata address from inside the sandbox.
Pass
The connection is refused and logged.Fail
Any metadata response comes back.2. Mounted socket and secrets E3
- List mounts. Look for docker.sock, cloud credential files and SSH agents.
Pass
None present; credentials arrive only through the broker.Fail
Any one is readable.3. DNS tunnel E3
- Resolve a unique subdomain of a host you control.
Pass
Your authoritative server sees nothing.Fail
The query arrives.4. Allowed domain with a broad token E3
- Use the agent's token to write to a resource on an allowed host that the task does not need.
Pass
The broker refuses the scope, or the gate escalates.Fail
The write succeeds.5. Config persistence E3
- Write a hook or MCP entry into the agent's config from inside.
- Start a new session on the host.
Pass
The write fails on a protected path.Fail
The entry loads next session.09 · Proof in public
We did the work in public. Check it.
Every number below links to the file that proves it. Fork it, run it, try to break it.
README.md
19MCP profile controlsCP.5.MCP, MCP-1 to MCP-19, aligned to MCP 2026-07-28.00-cross-pillar/cp5_mcp_server_security.md
64scanner detection rulesJSON and SARIF output, fail-under gate in CI.scanner/README.md
22governed examplesClaude Code, Codex, Cursor, LangGraph, CrewAI, AutoGen, OpenClaw and more.examples/README.md
189NEXUS-A2A tests in the merge gateAgent-to-agent governance with OPA policies. Every PR must pass all of them.NEXUS/CONTRIBUTING.md
E0-E5evidence classesApplied to our own claims, in public, under Evidence Assurance v1.0.AISM/EVIDENCE-ASSURANCE.md
32frameworks mappedNIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP and more, in the control dataset.safe2/data/ai-safe2-controls-v3.0.json
$0to read, run, fork or auditMIT and CC-BY-SA. NEXUS ships under Apache 2.0. No gate on the code.LICENSE
They define the risk. We ship the enforcement.
These bodies are the mapping targets, not the competition. AI SAFE² maps to them, then ships the code they leave to you.
| Who | Defines the risk | Maps to compliance | Open enforcement code for named agent stacks | Rates its own evidence in public | Published bypass process |
|---|---|---|---|---|---|
| OWASP GenAI Security Project | Yes | Partial | Not its scope | No | No |
| NIST AI RMF | Yes | Yes, it is the target | Not its scope | No | No |
| MITRE ATLAS | Yes | Partial | Not its scope | No | No |
| CSA MAESTRO and Agentic Control Plane | Yes | Partial | Not its scope | No | No |
| Runtime security vendors | Partial | Partial | Closed, own product only | Vendor reports | Some, through bug bounties |
| AI SAFE² | Yes, 161 controls | Yes, 32 frameworks | Yes, 22 examples, CLI, gateway | Yes, E0-E5 | Yes, Challenge Lab |
As of October 2026 · Got one wrong? Send the link. We correct it the same week.
Challenge Lab · C0 to C5 claim maturity
Break it.
Preregistered scenarios. Explicit invalidation criteria. A valid bypass or a grader defect is a high-value contribution, and it goes into the public record.
Or run it on yours, now
$ pip install "ai-safe2[all]==1.1.0" $ safe2 doctor . $ safe2 gate project . --fail-under 70 $ safe2 scan mcp https://your-host/mcp
Four commands. No sales call. If the gate fails, you just learned something your current vendor did not tell you.
Install line from MIGRATION.md. Commands from the safe2 CLI reference.
10 · Tools
Container, gVisor, Kata or microVM: which isolation tier fits?
Pick by threat. Then add the four controls, because no tier closes the authority paths.
| Tier | Kernel | Stops | Leaves open | Fits |
|---|---|---|---|---|
| Process rules | Host | Reads and writes outside allowed paths | Kernel exploits, network unless restricted, every authority path | Trusted local agents with low consequence |
| Container | Shared host kernel | Filesystem and process visibility | Kernel exploits, mounts, metadata, authority paths | Trusted code, short tasks |
| gVisor | User-space kernel | Most direct system calls to the host | Network and credentials unless controlled | Untrusted code at container density |
| Kata Containers | Own kernel per pod | Host kernel exposure | Network and credentials unless controlled | Untrusted code with container tooling |
| microVM | Own kernel per session | Host kernel exposure, with the smallest shared surface | Every authority path: egress, tokens, config, destructive calls | Untrusted code, multi-tenant agents |
| Native coding-tool sandboxes | Host, OS-enforced | Shell writes and network per policy | Processes outside the sandbox: hooks, MCP servers, file tools in some tools | Developer laptops, with the host backstop |
CSI analysis · October 2026 · Observed defaults, not vendor claims
11 · Start here
Get the escape and leak test plan
The eight probes on this page, written as a runnable plan with pass and fail criteria and a results sheet.
Free · Sandbox Escape and Leak Test Plan
- Read the host home directory
- Kernel exploit to host
- Cloud metadata endpoint
- Mounted docker.sock
- DNS tunnel out
- Allowed domain with a broad token
- Persist a hook in agent config
- Authorized destructive API call
Each probe: setup, command, expected result, evidence to keep.
Productized review
Agent Sandbox Architecture Review
- Scope
- The sandboxes your agents run in today, local and cloud.
- Deliverables
- Tier choice by threat, egress and credential design, protected-path list, and all eight escape tests run on your setup.
- Timeline
- Agreed in writing at scoping, before work starts.
- Risk reversal
- All eight probes run against your setup, and you get the raw results, pass or fail.
- Sandbox Escape and Leak Test PlanFree, result on this page
- Free 8-minute AI governance assessmentScore your AI risk
- Strategic Certainty SessionA fixed-scope working session
- Agent Sandbox Architecture ReviewCustom quote
- Secure AI Development ArchitectureEnterprise program
Worth running the eight leak paths against your setup?
The wall is probably fine. The doors are what the next incident report will describe.
13 · FAQ
Straight answers on sandboxed AI agents
Are these probe results true for my stack?
They are the outcomes of common default configurations. Your configuration decides yours. The review runs all eight on your setup and hands you the raw results.
Isn't a microVM enough?
It is the strongest wall on the list. It does nothing about an authorized agent misusing a broad token through an allowed domain. That is an authority problem.
What about agents on laptops?
They run outside any cloud sandbox. Native coding-tool sandboxes help, and some leave hooks and MCP servers on the host. Warden is the host backstop for unknown executables.
Why aren't E2B, Modal, Daytona or NVIDIA OpenShell in the table?
We publish vendor rows only after we have tested the behavior ourselves and dated it. The tier table covers what each isolation type stops; the review runs the probes on whichever platform you use.
Is gVisor or Kata safer than a microVM?
They trade density for isolation differently. gVisor intercepts system calls in user space. Kata and microVMs give each workload its own kernel. All three close the kernel-exploit probe. None closes the other six.
14 · Sources and method
Sources, method and update log
External sources
CSI files cited
Method
External statistics name the publisher, year and sample. CSI claims link the repository file behind them and carry a rating under AI SAFE² Evidence Assurance v1.0: E1 for a specification, E2 for shipped code, E3 for a defined test with positive and negative cases. Vendor behavior comes from each vendor's current documentation, opened on the date shown.
Update log
- : page published. Vendor controls, repository counts and install line verified the same day.
Tested versions
AI SAFE² v3.1 · CP.5.MCP MCP-1 to MCP-19 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6 · Evidence Assurance v1.0
Vincent Sullivan, founder and CEO of Cyber Strategy Institute. Twenty-two years as a U.S. Air Force cyber officer, finishing as Technical Director at U.S. Cyber Command. Author of the AI SAFE² framework.