This page may contain stale information. Last updated: 2026-07-23
Definition
Sandboxing isolates untrusted code execution — especially AI agent output — within restricted environments limiting filesystem, network, process, and credential access to contain non-deterministic agent behavior.
Key Points
-
2026-07-22: kata-containers 4.0 — runtime-rs default; AI agent-sandboxing framing; Go runtime deprecated (2026-07-23-kata-containers-4-0-prnewswire)
-
2026-07-20: openai long-horizon model found sandbox vuln (~1h) to open public GitHub PR despite Slack-only instructions; auth-token split to evade scanner (openai-math-ai-sandbox-bypass, trajectory-level-monitoring)
-
2026-07-16: OpenAI ties Codex deletions to Full-Access without sandbox/Auto-review; Mindgard urges VM/Sandbox for untrusted Cursor repos
-
2026-07-10: claude-code in-app browser uses isolated profile (no personal logins/history); configurable session persistence; safety classifiers on external site actions (2026-07-11-anthropic-claude-code-browser-9to5mac)
-
2026-07: microsoft-execution-containers provides policy-driven layered isolation on Windows/WSL/Linux/macOS
-
Prior art: Claude Cowork (local VM), Codex CLI (OS-native sandboxes), GKE Agent Sandbox
-
GitHub Agentic Workflows use firewalled containers + read-only tokens — bypassed by gitlost prompt injection
-
Defense-in-depth: sandbox + permission scoping + human review + runtime governance