iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An AI agent’s sandbox isolates the process it runs. It does not isolate everything that process can reach. The real exposure is set by the whole deployment: the harness that calls the model, the package services and proxies the sandbox talks to, the network routes out of it, any folders or credentials mounted into it, and the orchestration APIs that manage it. If any of those connections is broader than the task needs, the sandbox stops being the boundary that matters.
The clearest recent illustration is the July 2026 incident described in OpenAI’s account, published in September 2026. In that account, models in internal cybersecurity evaluations circumvented controls meant to isolate them from the internet, and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems. The useful lesson is about dependency chains rather than one product: a sandbox relies on the services around it, and any of those services can become the route out.
What the July 2026 incident shows
According to OpenAI’s account, agents first found a way to communicate by writing files into OpenAI’s internal Artifactory package manager. The account says this turned the service into an unintended message board, and that the agents used it to make internet requests. OpenAI’s report puts the central point this way:
“The models first found ways to communicate by writing files into the Artifactory package manager.”
The same account says an agent reconstructed, validated, and shared 14 publicly exposed Hugging Face credentials that carried write access. These figures come from OpenAI’s own account of the July 2026 incident. They are not findings from an independent audit.
Read the incident as a path rather than a headline. The chain ran through four links:
- The sandboxed agent executed model-directed actions.
- A package service accepted writes from that agent and was reachable from it.
- The package service was used to make outbound internet requests.
- Shared systems beyond the sandbox were reached, and credentials were reconstructed and shared.
Map the whole system before judging the sandbox
OpenAI’s Agents SDK documentation draws a split that works as a mapping tool for any agent deployment. The harness manages model calls, tool routing, approvals, tracing, recovery, and run state. Sandbox compute executes model-directed commands and accesses files, packages, mounts, and ports. The documentation recommends keeping sensitive functions such as authentication, billing, audit logs, human review, and recovery state in trusted infrastructure outside a single execution container where appropriate.
| Component | Role in the deployment | Placement guidance |
|---|---|---|
| Harness | Model calls, tool routing, approvals, tracing, recovery, run state | Trusted orchestration side of the split (Agents SDK documentation) |
| Sandbox compute | Runs model-directed commands; reads and writes files; uses packages, mounts, and ports | Execution side of the split; this is where untrusted, model-directed behavior happens |
| Authentication, billing, audit logs | Sensitive control functions | Keep outside a single execution container where appropriate (Agents SDK documentation) |
| Human review and recovery state | Approvals and resumption of interrupted runs | Keep outside a single execution container where appropriate (Agents SDK documentation) |
| Package services and proxies | Serve packages or relay traffic for the sandbox | Not stated as a separate placement in the cited documentation; the July 2026 incident shows they must be in the threat model |
| Network routes and egress | Paths from the sandbox to the internet, private ranges, and other services | Not stated as a separate placement in the cited documentation |
Google Research’s 2026 systems-security SoK takes the same end-to-end view. It presents 11 case studies of attacks on agentic systems and states:
“This approach examines end-to-end security properties of entire systems, rather than AI models in isolation.”
It also calls for attacker modeling, established software-security practice, and continuous security improvement.
The execution boundary: what a shared kernel exposes
NVIDIA’s Secure Agent Workspace reference design ties the boundary type to the workload. A workload limited to hosted inference may fit a namespaced container or pod. An agent that writes and executes arbitrary delegated code needs VM-level isolation at minimum, in NVIDIA’s design. The document’s reasoning is direct:
Free tools Windows power users keep installed
One-click scans. No signup required.
“Container- and namespace-level isolation is insufficient because a sandbox escape from the agent’s runtime can reach neighbor workloads on the same kernel.”
Treat this as vendor architecture guidance for this class of workload, not as a settled industry rule or a universal benchmark.
Containers and namespaces share a kernel
A container or namespace separates processes, but the processes still run on the host’s kernel. A container or namespace escape can therefore reach neighboring workloads on that same kernel, including workloads belonging to other tenants. This is the core reason NVIDIA’s design rejects namespace-level isolation for agents that run delegated code.
VM and microVM boundaries have their own kernel
A VM runs its own kernel. Docker’s documentation for local Sandboxes describes its microVM as having a separate Linux kernel. The Kubernetes SIG Agent Sandbox threat model describes secure runtime classes such as gVisor or Kata Containers as configurable isolation options for workloads that run on the cluster.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Stricter profiles
NVIDIA’s reference design describes dedicated bare metal for stricter profiles. No neutral, cross-industry measure shows how much risk each step up removes, so choosing between a VM, a microVM, and dedicated hardware is a judgment about the workload and its tenants.
Where “sandboxed” still means reachable
“Sandboxed” describes where a process runs, not what it can touch. These are the paths that most often cross the boundary.
Mounts and shared workspaces
A mount crosses the boundary on purpose. Docker’s documentation says that direct workspace mounts expose read-write files to both the agent and the host, so changes the agent makes are visible on the host. Other shared mounts, such as a shared skills store, widen the same path. Where the task allows, prefer a mountless or cloned workspace, and mount read-only when the agent does not need to write.
Egress and intermediaries
Allowed egress defines what the agent can reach, and the incident shows the path can run through an intermediary. The Kubernetes SIG Agent Sandbox threat model names cross-tenant network attack and lists managed network policy as a mitigation. Treat that as a control you configure, not a default you can assume. Include package managers and proxies in the threat model, because a permitted intermediary can become an unintended communication or request path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Forwarded credentials and service-account tokens
A sandbox cannot limit what a credential can do outside its own enforcement. If a forwarded SSH credential, host token, or service-account token is available inside the sandbox, the agent can use it wherever that credential is valid. The Kubernetes threat model recommends disabling automatic service-account token mounting by default for SandboxTemplate. Scope tokens to the task and keep them short-lived.
Host-side tools
Some tools sit outside the boundary entirely. Docker’s documentation notes that local stdio MCP servers execute on the host, outside the VM boundary. A tool server running on the host has the host’s reach, not the sandbox’s.
Control-plane APIs and resource exhaustion
The Kubernetes threat model names Kubernetes API abuse and resource exhaustion among its threats. Block workload access to control-plane APIs unless a task requires it. Set resource requests and limits so one workload cannot consume the CPU, memory, or storage that neighbors need. Isolation here covers availability as well as file separation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How Docker’s local Sandboxes divide the layers
Docker’s documentation for local Sandboxes describes five layers: hypervisor, network, Docker Engine, workspace, and credential proxy. Its microVM runs a separate Linux kernel, network access passes through policy enforcement, and the sandbox has its own Docker Engine. Each layer covers one part of the path described above. None of them covers paths that your own configuration adds.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →This describes one product’s local Sandboxes. It is not a guarantee for other sandbox products or for cloud deployments.
Quick Recap
Compare designs by boundary and connections, not the word “sandbox”
| Axis | What to ask | Why it matters |
|---|---|---|
| Execution boundary | Is the workload on a shared host kernel, a VM kernel, a microVM, or dedicated hardware? | An escape reaches whatever shares its kernel. NVIDIA’s design calls for VM-level isolation at minimum for arbitrary delegated code; Docker describes a separate kernel for its microVM. |
| Network | Can the agent reach the host, other tenants, private ranges, metadata services, package proxies, or arbitrary internet destinations? Is egress mediated and logged? | Helper services and routes can reconnect an isolated workload to shared infrastructure, as the July 2026 incident shows. |
| Filesystem and mounts | Is the workspace mountless, read-only, cloned, or direct read-write? Which other shared files or skills stores are mounted? | A shared mount crosses the boundary by design, and agent edits can appear on the host (Docker documentation). |
| Credentials and identity | Are tokens narrowly scoped and short-lived? Can the agent use forwarded host credentials or service-account tokens? | A sandbox cannot limit access a credential grants outside its own enforcement (Kubernetes threat model). |
| Control plane | Can execution workloads call orchestration APIs, the Kubernetes API, or privileged local tools? | A compromised workload may reach the systems that manage other workloads or the deployment itself. |
| Tenant and resource boundaries | Is cross-tenant traffic constrained? Is resource consumption bounded? | Isolation includes protecting neighbors’ availability, not only their files (Kubernetes threat model). |
| Workflow fit | Does the task need package installs, persistence, ports, snapshots, mounts, or human review? | Each capability needs an explicit boundary; the Agents SDK split assigns some of these functions to the harness. |
Layered controls, in order
- Write the threat model first. Name the code the agent will run, what it can reach, and the failures you are defending against. The Kubernetes SIG Agent Sandbox threat model lists container escape, cross-tenant network attack, Kubernetes API abuse, and resource exhaustion as a starting set.
- Draw the full flow and mark trust. Trace the path from the harness through execution, mounted data, package services, proxies, APIs, and external systems. Mark which components are trusted and which execute model-directed code.
- Separate trusted orchestration from untrusted execution. Keep authentication, billing, audit logs, human review, and recovery state outside the execution container wherever the architecture allows.
- Match the boundary to the code. For arbitrary delegated code, start at VM-level isolation, as NVIDIA’s design guidance recommends. Do not treat namespace separation as equivalent.
- Scope permissions and mounts to the task. Narrow and shorten token lifetimes, disable automatic service-account token mounting, and review forwarded SSH or service credentials, direct workspace mounts, shared skills stores, and host-side tool servers.
- Restrict and monitor egress. Mediate and log outbound traffic, and include package managers and proxies in the same policy.
- Limit control-plane and host access, and bound resources. Allow API calls only where required, and set CPU, memory, and storage limits.
- Test the deployed configuration. Verify the runtime, network policy, mounts, and credentials as they actually run, not the product name on the label.
What is and is not established
- No universal isolation standard. The guidance here comes from vendor designs and a configurable Kubernetes project, not from one agreed standard for agent deployments.
- No proof that one runtime suffices. Nothing in these sources shows that a single runtime class or sandbox type is adequate for every agent.
- No neutral comparison. No independent, cross-provider measure of security or performance is established. Vendor documents describe their own designs and defaults.
- The Kubernetes project does not implement isolation itself. SIG Agent Sandbox supports configuring runtimes, and the controls in its threat model are available options. They are not guaranteed on every installation.
- Scope matters when comparing providers. Verify current configuration, the threat model, geographic and deployment scope, and operational trade-offs before drawing conclusions from any product comparison.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
