The independent reference for AI agent sandboxesLast reviewed
Agent Sandboxesagentsandboxes.org
Guide

Agent sandbox security checklist

Answer in brief

Secure an agent sandbox by layering controls: strong isolation (microVM or gVisor), default-deny network egress with an allowlist, no long-lived secrets inside the sandbox, CPU/memory/time limits, fresh sandboxes per user or task, full logging of commands and network calls, and human approval for irreversible actions outside the sandbox.

By the Agent Sandboxes editors · Updated

The checklist

Isolation

  • Use VM-grade isolation (microVM) or gVisor for untrusted code from multiple users.
  • One sandbox per user, per task, or per conversation — never share a sandbox across tenants.
  • Run as a non-root user inside the sandbox where possible.

Network

  • Default-deny egress; allowlist package registries and the APIs the task needs.
  • Block cloud metadata endpoints (for example 169.254.169.254) if you self-host.
  • Expose inbound ports only through authenticated preview URLs.

Secrets

  • Do not put long-lived keys in the sandbox environment. Prefer short-lived, narrowly scoped tokens or a credential-injecting proxy.
  • Assume the agent can read anything inside the sandbox, and that anything it reads could be sent out if egress is open.

Resources

  • Set CPU, memory, disk and wall-clock limits; set an idle timeout.
  • Cap concurrency per user to prevent abuse (crypto mining is a common one).

Prompt injection

  • Treat web pages, repository files, issues and tool outputs as untrusted input. See prompt injection.
  • Require human approval for actions with external side effects: pushing code, sending messages, payments, deleting data.

Audit

  • Log every command, file write and outbound connection with the sandbox and user ID.
  • Keep snapshots or logs long enough to investigate incidents.

Local coding agents

Coding agents running on a developer laptop deserve the same thinking. Run them in a container, a VM or an OS-level sandbox (for example macOS Seatbelt or Linux bubblewrap) with filesystem access limited to the project directory and network access limited to what the task needs.

Frequently asked questions

Does a sandbox stop prompt injection?
No. It limits the damage. Prompt injection changes what the agent decides to do; the sandbox limits what those actions can reach. You need both isolation and egress/credential controls.
Is it safe to give an agent internet access?
It depends on what the sandbox holds. Internet access plus secrets plus untrusted input is the classic exfiltration recipe. Remove at least one of the three — usually by allowlisting egress and keeping secrets out.

Sources

  1. owasp.org/www-project-top-10-for-large-language-model-applications/

Cite this page

Agent Sandboxes. (2026). Agent sandbox security checklist. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/guides/agent-sandbox-security-checklist/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.