Sandbox

How it works

A sandbox puts walls around code. The code can do its work in the walls. When the code tries to go through them, the operating system stops it.

For an AI agent, two walls are the most important:

• Files. The agent can read and write in one work folder. The Claude Code sandbox from Anthropic blocks “the modification of any files outside of it”.
• Network. The agent can connect only to approved addresses. In Claude Code, all traffic goes through a proxy server out of the sandbox. The proxy controls which domains the code can connect to. In Codex from OpenAI, with public internet access off, commands connect only to hosts on a managed allowlist.

Claude Code and Codex use features of the operating system to apply these limits: Seatbelt on macOS and bubblewrap on Linux. The limits also apply to each command that the agent starts. Many other agent systems use a Docker or OCI container as the sandbox.

Anthropic says that the two walls are necessary. With no network wall, a compromised agent can send out sensitive files such as SSH keys. With no file wall, the agent can “easily escape the sandbox and gain network access”.

Why it matters

An agent can do damage by mistake. A prompt injection can also tell the agent to do damage. A sandbox does not stop the bad command. It limits what the command can touch. Code that the agent must not operate is the risk of unexpected code execution.

A sandbox also changes how frequently a person must give approval. OpenAI says the sandbox “defines technical boundaries” and the approval policy decides “when the agent must stop and ask before crossing them”. Anthropic says that constant approval “can lead to ‘approval fatigue’”. Anthropic reports that, in its internal use, the sandbox cut permission prompts by 84%. That number is a vendor figure for one product. Human-in-the-loop gives more about the approval control.

Trade-offs

A sandbox is only as strong as its configuration. In March 2026, UK AI Security Institute researchers published SandboxEscapeBench. It tests if a model with shell access can break out of a container. The researchers added known faults on purpose.

Frontier models “reliably escape common sandbox weaknesses”. Examples are privileged containers, writable host mounts and an exposed Docker daemon. On harder tasks, the largest models succeeded “at meaningful rates on level 3 tasks”. They had “zero success on levels 4 and 5”.

The paper also shows a difference in practice. Large inference providers usually use microVMs such as Firecracker, or userspace kernels such as gVisor. Much of the open source agent ecosystem and local developer tools use standard Docker containers.

Questions and answers

Why do AI coding agents work in a sandbox?

A coding agent starts commands and changes files, and a person does not examine each step. A sandbox keeps those commands in set limits on files and network. OpenAI calls its sandbox "the boundary that lets the agent act autonomously without giving it unrestricted access to your machine".

Is a Docker container a safe sandbox for an AI agent?

Only with a correct configuration. In a 2026 UK AISI benchmark, frontier models escaped containers with usual faults. Examples are privileged containers, writable host mounts and an exposed Docker daemon. The paper says that large inference providers usually use microVMs such as Firecracker, or userspace kernels such as gVisor.

What is the difference between a sandbox and human approval?

A sandbox sets technical limits that the code cannot go through. Approval is a stop for a person to accept or refuse a step. OpenAI says the sandbox "defines technical boundaries" and the approval policy "decides when the agent must stop and ask before crossing them".