Sandbox
An isolated environment where an agent can act without risk to real systems.
A disposable, restricted execution environment — container, VM or restricted shell — inside which an agent’s actions cannot reach production data or the wider network.
The sandbox is what makes unsupervised agents tolerable. Contain the blast radius and you can raise autonomy; skip it and every mistake is potentially permanent.
A sandbox is only as good as its boundary. Code execution without network and filesystem limits is not really a sandbox; a container with the host credentials mounted is a sandbox in name only. The check worth doing is asking what the worst case is if the model’s action is deliberately malicious.
Running generated code safely
An agent writes and executes scripts as part of its work.
Execute in a disposable container: no host filesystem, no credentials, no network except an explicit allowlist. The agent gets the feedback loop that makes it useful, and the blast radius of a bad decision stays inside something you can delete.
Prompt injection meets an unsandboxed shell
A browsing agent reads a page containing hidden instructions.
The content is untrusted by definition, and an agent with an unrestricted shell can be talked into using it. Sandboxing is not optional hardening here — it is the control that makes the failure survivable.
- blogCode execution with MCP: building more efficient AI agents ↗
Presenting tools as a code API so the agent loads only what it needs and filters results in the sandbox instead of pushing large intermediate data through the context window.
- docsComputer use ↗
Two GUI-agent patterns — structured mouse and keyboard actions, or code driving a browser — and where the runtime owns screenshots, sessions, limits and permissions.
- blogScaling managed agents: decoupling the brain from the hands ↗
Separates model, harness, durable session log and execution sandbox — the architecture that makes long-running agents survive crashes and tool boundaries.
Environment
The world outside the model that tools act upon.
Permission Mode · Autonomy level
How much the agent may do without asking.
Agent Mode
The mode where the assistant acts instead of suggesting.
AFK · Away from keyboard
Running without a person watching.