AI Systems Atlas

S-14Sandbox Anatomy

/security/sandboxing

Disk, process and network are three separate edges — and a sandbox is only as good as the weakest one.

Step-by-step walkthrough7 steps
  1. The agent runs code. The question is never “will it misbehave” but “what can it reach when it does”.
  2. Everything it runs happens inside one box with three edges: disk, process, network.
  3. Disk is a disposable copy. Destroying it costs a rebuild, not a repository.
  4. Host secrets are not mounted — the exfiltration plate’s first ingredient simply is not present.
  5. Every outbound request meets an allowlist, not a firewall rule written after the fact.
  6. Named hosts resolve. The package registry the build genuinely needs still works.
  7. Everything else is unreachable, so an exfiltration channel has nowhere to send to.
Key insight

Sandboxing is the defense that does not depend on the model being right about anything. The question is never whether the agent misbehaves, but what it can reach when it does.

Failure mode

A container with the host’s credentials mounted and unrestricted egress. That is a process boundary, not a security boundary, and it stops nothing that matters.

Further reading
RelatedData exfiltrationUnsafe side effectsSecrets brokerComputer-use coding

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →