S-14Sandbox Anatomy

Disk, process and network are three separate edges — and a sandbox is only as good as the weakest one.

Key insight

Sandboxing is the defense that does not depend on the model being right about anything. The question is never whether the agent misbehaves, but what it can reach when it does.

Failure mode

A container with the host’s credentials mounted and unrestricted egress. That is a process boundary, not a security boundary, and it stops nothing that matters.

S-14Sandbox Anatomy

Elsewhere in the atlas