Agent Sandbox
conceptAn isolated execution environment that constrains what an AI agent can access and modify — preventing unintended side effects.
An agent sandbox is a controlled environment that limits what an AI agent can do. When an agent executes code, calls APIs, or modifies files, the sandbox ensures these actions cannot affect systems outside its boundaries.
Sandboxing approaches include: container isolation (Docker, Firecracker), filesystem restrictions (read-only mounts, temp directories), network controls (blocking unauthorized outbound requests), resource limits (CPU, memory, time), and capability-based security (agents only get the permissions they need).
Sandboxing is critical for production agent systems where agents have tool access. Without it, a confused or compromised agent could delete files, exfiltrate data, or consume unlimited resources. OpenClaw sandboxes skill execution; SUBCORP uses containerized tool execution with network and filesystem restrictions.