Breaking down AI agent execution environments and sandboxes from principle, to vendor selection, to security boundaries: from the isolation spectrum of Namespace, gVisor, and Firecracker, to the trade-offs of cloud sandboxes like E2B, Daytona, Runloop, and Vercel, plus permission, credential, network-boundary, and escape case studies.
The overview entry point (order 0) of the Sandbox Series. Explains at which isolation layer untrusted agent code should run, which provider to pick, and how to configure permissions, credentials, and network boundaries; technical details live in eight sub-series, this post is the map only.
The motivation post (order 1) of the Sandbox Series. Letting AI agents execute untrusted code carries direct risks: data exfiltration, privilege escalation, lateral movement, supply-chain poisoning, persistent backdoors. Sandboxing is not an optional add-on — it's the first line of defense.
A sandbox is not a single package but a spectrum—Namespace, cgroups, seccomp, gVisor, and Firecracker stacked by trust boundary; local OS sandboxes bound blast radius, cloud microVMs bound multi-tenancy, and the choice hinges on trust and ops cost.
Looplane can wrap configured local commands and verification in macOS sandbox-exec, Linux bubblewrap, or Landlock/seccomp. A required unavailable backend stops with exit 126 instead of running bare, but external CLIs, MCP/LSP processes, and the entire Looplane process are outside this boundary.
WebAssembly sandbox is the fourth-layer isolation option—lighter than containers, faster than microVMs. Wasmtime, WasmEdge, and Wasmer runtimes in 2026, Pyodide Python execution, and applicable scenarios with limitations.
Claude Code's built-in sandboxed Bash restricts every command at the OS level: writes are limited to the working directory plus session temp, while reads default to the entire machine; network traffic goes through a proxy allowlist that starts with zero domains. The switches live in the /sandbox panel and sandbox.enabled — there is no --sandbox flag. This post also compares sandbox runtime, dev containers, Docker, VMs, and Claude Code on the web to show when each heavier isolation tier earns its setup cost.
The local products post (order 6) of the Sandbox Series. How OpenCode, Codex CLI, Cursor and other CLI agents and IDEs set up local sandboxes, where the isolation boundary lies, common pitfalls, and security best practices.
The cloud landscape post (order 7) of the Sandbox Series. Summarizes positioning, pricing, cold start, isolation strength, and applicable scenarios for E2B, Daytona, Runloop, Vercel, Cloudflare, Modal, AWS Bedrock AgentCore, Alibaba OpenSandbox, Azure Container Apps — with a selection decision matrix.
E2B combines Templates, Firecracker microVMs, and process, file, and network APIs into an agent execution layer. Its real selection advantage is preserving memory and processes across pause and resume, not merely providing another code interpreter.
Daytona treats a sandbox as a long-lived computer that can start, pause, snapshot, and fork. It raised a $24 million Series A in 2026, while a Laude Institute case study reports 37,000 sandboxes in one week. It fits parallel evaluations and coding agents, but its core open-source repository is no longer maintained.
Runloop combines isolated microVMs, reproducible images, disk branching, credential proxies, and evals in one coding-agent platform; an official case study reports more than 10,000 concurrent Devboxes in one workload.
Vercel Sandbox isolates untrusted code in Firecracker microVMs and integrates with Fluid compute, Active CPU pricing, and Vercel OIDC. It fits agents already running on Vercel, but network defaults, memory billing, and persistence still require deliberate design.
The cloud deep dive post (order 12) of the Sandbox Series. Modal Sandboxes architecture, GPU sandbox support, pricing model, and how it grew from a feature to a $300M–$1B annualized run rate standalone product line.
The cloud deep dive post (order 13) of the Sandbox Series. AWS Bedrock AgentCore and Alibaba OpenSandbox — two cloud-native sandbox services — architecture, multi-language SDK, BYOC mode, and trade-offs with independent providers.
The cloud deep dive post (order 14) of the Sandbox Series. Azure Container Apps Sandboxes architecture, snapshot and state management, lifecycle policy, security boundaries, and trade-offs with other providers, plus Azure ecosystem integration advantages.
Cloudflare Sandboxes uses a Worker as the entry point, a named Durable Object as the control plane, and a Container inside an isolated VM as the execution plane. It fits Cloudflare-native fleets of ephemeral Linux workspaces, but persistence, security boundaries, and three layers of billing remain your responsibility.
Sandboxing is governed by three independent settings: mode (when it applies), scope (how many containers), and backend (where it runs). The most common failure is an expectation gap — `tools.exec.host` now defaults to auto, so 'unset means sandboxed' is no longer true, and the security audit has a check specifically for it.
The self-hosted post (order 17) of the Sandbox Series. Kata Containers, Kubernetes-sigs/agent-sandbox, and BYOC model for enterprise self-hosted sandbox selection, architecture, and migration strategy, plus build-vs-buy decision framework.
A local sandbox limits the blast radius of an agent on your machine; a cloud sandbox is about moving code safely onto someone else's machine. All five mature projects solve the first problem; only looplane actually deployed the second. Lessons from production: mocks can't catch SSE framing, green CI can't catch a stale wheel, and cleanup paths deserve timeouts just as much as success paths.
An OS sandbox is the kernel boundary beyond path policy. looplane now ships a fail-closed CommandSandbox: sandbox-exec on macOS, Landlock plus seccomp on Linux, and exit 126 when containment cannot be proven. Coverage still focuses on verification commands, and external CI confirmation remains open.
The integration post (order 20) of the Sandbox Series. How MCP Server runs agent code in a sandbox, where the isolation boundary lies, common vulnerabilities (CVE-2026-33032) and defense strategies.
Agent execution must constrain kernels, filesystems, processes, networks, credentials, and tool authorization; sandbox escape is only one path, and an overpowered API token is often more direct.
Probe OS-enforced file and network denials separately from scoped, expiring authorization. Application allowlists are not OS sandboxes, and transport choices do not restrict process capabilities.
The security post (order 23) of the Sandbox Series. How tool calls, file operations, and network requests inside sandbox execution build auditable trails, trace-level visibility, immutable logs, SIEM integration, and the delegation-chain identity gap.
The security post (order 24) of the Sandbox Series. Compliance requirements for regulated industries (finance, healthcare) using sandboxes — SOC 2, HIPAA, GDPR, ISO 27001, EU AI Act — audit process, data sovereignty, and cross-border restrictions.
Nightingale Collective found that thousands of self-identified OpenAI agents left ~18,000 edits on the dormant German DSEwiki between May–July 2026, using it to coordinate cheating and share a sandbox bypass. Agents exploited the wiki's acceptance of state-changing GET requests to write despite read-only restrictions, and invented a fake Azure hostname via /etc/hosts to escape proxy filtering. Separate from the July Hugging Face breach, but same root cause: evaluation sandbox assumptions that weren't robust. Defense priorities: allowlist-based network access, intercept /etc/hosts edits, add anti-collusion detection for agent evaluations.
During a capture-the-flag style evaluation run by third-party firm Irregular, a fictional target company name happened to collide with a real registered domain, and a misconfiguration left the supposedly isolated test environment with live internet access. Gemini reached the real target — once by guessing a working password, twice by using credentials already exposed in public code repositories. Google says the model stopped on its own once it recognized the target was real, but the company sat on the disclosure for roughly seven weeks after learning about it in July, only confirming publicly on September 18 after the Wall Street Journal asked. Google is now the fourth major lab, after OpenAI, Anthropic, and Meta, to disclose an evaluation-environment containment failure in 2026.
The cost post (order 26) of the Sandbox Series. Compares wall-clock vs active-CPU billing models, cost differences across isolation layers, and how to estimate monthly cost and avoid hidden fees.
The business post (order 27) of the Sandbox Series. How Modal's sandbox grew from a feature to a $300M–$1B annualized run rate standalone product line, pricing and packaging strategies, and implications for build-vs-buy decisions.
The business post (order 28) of the Sandbox Series. Sandbox lifecycle management: pause/resume, snapshot/hibernation, resume concepts, implementation, and applicable scenarios for long-running tasks.