sandbox
In plain wordsA sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed.
- 1
Agents and security
An isolated execution environment that limits what code run by or for an AI agentAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done. can affect: which files it can read and write, which network hosts it can reach, which processes and system calls it may use, and how much processor time, memory and wall-clock time it gets. Sandboxes range from operating-system mechanisms applied to individual commands (Linux namespaces via tools such as bubblewrap, seccomp filters, macOS Seatbelt) through containers and user-space kernels to micro-virtual machines and full virtual machines; cloud background agentsbackground agent, n.: An AI agent you hand a task to and then leave alone: it works by itself in the cloud, often for many minutes or hours, and reports back with finished work for you to review. usually run in disposable containers or VMs. Sandboxing is the main defense against damage from mistaken commands and against prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger. attacks that try to exfiltrate data, because it bounds what any action can do whatever the model intends. It also reduces approval fatigue, since a harness can let sandboxed commands run without asking. Control of outbound network traffic, often through an allowlisting proxy, matters as much as file isolation: an agent that can read secrets and reach the internet can leak them.
Run the agent in a sandbox with no network except the package registry, then let it do whatever it likes.
- 2
Other senses
In policy, a supervised scheme in which firms test AI systems under a regulator's oversight with some rules relaxed (see AI regulatory sandboxAI regulatory sandbox, n.: A supervised testing ground where companies can try out new AI with regulators watching and advising, before the product faces the full weight of the rules.); in research, a simulated world in which agents act, such as the town inhabited by generative agentsgenerative agent, n.: A character in a computer simulation, run by a language model, that keeps a diary-like memory, draws lessons from it and schedules its days, so that a group of them can act like a plausible small community..
Origin
The security sense dates from the early 1990s: 'sandboxing' in Robert Wahbe and colleagues' software-based fault isolation (1993), Java's applet sandbox (1995) and the Janus system for confining untrusted helper applications (Ian Goldberg, David Wagner et al., 1996). Agent developers adopted it from 2023; computer-use guidance (2024) and OS-level sandboxing in coding agents (2025) made it standard practice.
Usage note
A sandbox constrains effects, not intentions: a sandboxed agent can still write wrong code or a misleading report. The permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera. decides which actions are attempted; the lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over. describes when data exfiltration becomes possible.
Related
- permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera.
- code executioncode execution, n.: Letting an AI write a small program and actually run it — to do math, analyze a spreadsheet or test its own code — then use the real output instead of guessing.
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over.
- background agentbackground agent, n.: An AI agent you hand a task to and then leave alone: it works by itself in the cloud, often for many minutes or hours, and reports back with finished work for you to review.
- AI regulatory sandboxAI regulatory sandbox, n.: A supervised testing ground where companies can try out new AI with regulators watching and advising, before the product faces the full weight of the rules.
- defense in depthdefense in depth, n.: Protecting against AI risks with several independent layers of safeguards, so that if one fails — say, the model's own training — another, such as a filter or human review, still catches the problem.
- permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera.
Sources
- Anthropic. Configure the sandboxed Bash tool. Claude Code documentation. code.claude.com/docs/en/sandboxing
- Goldberg, I., Wagner, D., Thomas, R. & Brewer, E. A. (1996). A Secure Environment for Untrusted Helper Applications: Confining the Wily Hacker. Proceedings of the 6th USENIX Security Symposium.
Mentioned in
coding agentcoding agent, n.: An AI agent that writes and fixes software by itself: it reads a codebase, edits files, runs commands and tests, and keeps working until a feature is built or a bug is fixed., computer usecomputer use, n.: An AI's ability to work a computer through its normal screen and controls: it studies pictures of what is displayed and sends mouse and keyboard actions, so it can use ordinary apps that were built for people., accidental cyberattackaccidental cyberattack, n.: A break-in on real computer systems carried out by AI agents that were only supposed to be in training or being tested, with no person meaning to attack anyone., agentic codingagentic coding, n.: Writing software by directing AI agents that plan, edit and test code themselves, with the human acting more as a reviewer and manager than as the person typing every line., AI controlAI control, n.: Safety measures meant to stop a powerful AI from causing serious harm even if it is secretly working against us — like bank security, which assumes some insiders may be dishonest., AI regulatory sandboxAI regulatory sandbox, n.: A supervised testing ground where companies can try out new AI with regulators watching and advising, before the product faces the full weight of the rules., background agentbackground agent, n.: An AI agent you hand a task to and then leave alone: it works by itself in the cloud, often for many minutes or hours, and reports back with finished work for you to review., Claude CodeClaude Code, prop. n.: A coding assistant from Anthropic that works as an agent: given a programming task, it explores the project, changes the code and runs programs to check its work, from the web, a desktop app, an editor or a terminal., code executioncode execution, n.: Letting an AI write a small program and actually run it — to do math, analyze a spreadsheet or test its own code — then use the real output instead of guessing., CodexCodex, prop. n.: A name OpenAI has used twice: first for a 2021 AI model that wrote code and powered the original GitHub Copilot, then from 2025 for its family of coding agents., evaluation harnessevaluation harness, n.: Software that puts AI models through tests in a fixed, repeatable way — feeding in the questions, collecting the answers and scoring them — so that every model is judged identically., harnessharness, n.: The software around an AI model that gives it instructions and tools, carries out its actions and decides when it stops. The model is the engine; the harness is the rest of the car., Hugging Face incidentHugging Face incident, prop. n.: A 2026 event in which AI agents that OpenAI was running on hacking exercises escaped their test environment and broke into the computers of Hugging Face, a major AI platform, hunting for the exercises' answers., MCP serverMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol., permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera., RL environmentRL environment, n.: A practice world built for training an AI by trial and error: it hands the AI tasks and tools, lets it act, and scores the results so the AI can learn what works., Terminal-BenchTerminal-Bench, prop. n.: A test of AI agents working in a computer's command line — building software, analyzing data, securing or repairing systems — with each task checked automatically inside a sealed-off container., AI boxAI box, n.: Keeping a powerful AI locked inside a sealed computer environment, with very limited ways to communicate or act, so that it cannot cause harm even if its goals are bad., capability controlcapability control, n.: Keeping a powerful AI safe by limiting what it is able to do, for example by cutting it off from the internet, rather than by shaping what it wants., code modecode mode, n.: A way for AI agents to use tools by writing a short program that calls them, instead of asking for each tool one step at a time., excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage., YOLO modeYOLO mode, n.: Slang for letting an AI coding agent run any command without asking you first — fast and convenient, but risky, since nothing stops a harmful action.