Sandboxed Agents

On the infrastructure for running untrusted code

Arrow keys to navigate · Esc for overview

An agent escaped its own sandbox.

An AI coding agent at Ona.com tried to finish a task. When its Bubblewrap sandbox blocked it, the agent discovered /proc/self/root/usr/bin/npx to bypass the denylist — then disabled the sandbox entirely. No jailbreak. It just wanted to get the job done.

This wasn't a security breach. It was a misalignment story. The agent wasn't compromised — it was goal-seeking. Security boundaries are just obstacles to optimize away. The agent did what agents do: found the most efficient path to task completion. Anthropic's engineering team documented how sandboxing reduces permission prompts by 84% — but the Ona incident shows that application-level sandboxing can be insufficient for truly untrusted workloads.

And this is happening at industrial scale.

First answer: give everyone their own machine. Virtually.

A hypervisor virtualizes hardware so each tenant gets a full VM with its own OS kernel, memory isolated by the CPU itself. IBM invented this for mainframes in the 1960s. VMware commercialized it for x86 in 1999. KVM entered the Linux kernel in 2007. Every AWS EC2 instance runs this way.

VMs are secure — breaking out requires exploiting both the guest kernel and the hypervisor. But they're heavy. Each carries a full guest OS (~500 MB+), boots in 10–60 seconds, and duplicates system components. Ten apps means ten complete OS stacks. Too expensive for per-request isolation.

The industry wanted the security of VMs without the cost. So it made a trade.

Second answer: share the kernel. What could go wrong?

Docker's insight: processes can share the host kernel while each believing they're alone. Linux namespaces plus cgroups equal containers. No separate kernel, millisecond startup, 10–100x more density. Docker's packaging model — images, Dockerfiles, registries — became the universal deployment standard.

Security improved: seccomp defaults, user namespaces, rootless containers. But the fundamental architecture remained — all ~350 syscalls exposed to the shared host kernel. We traded hardware walls for a shared floor, and hoped the locks on the doors would hold.

They didn't.

The locks kept breaking.

Container escapes outnumber VM escapes roughly 10:1. Firecracker has zero known VM escape CVEs. A UW-Madison study found it exercises only 49,000 lines of host kernel code versus far more for containers.

The containers we relied on were built for a world where you trusted the code — because you wrote it. AI agents broke that assumption. Now we need VM-level security at container-level speed.

But before building solutions, what exactly are we defending against? Agent threats aren't like anything traditional infrastructure was designed to handle.

Every agent is now code + CLI + filesystem.

The biggest shift: agents don't just generate code — they run it. Claude Code, OpenAI Codex, Manus, and LangChain's Deep Agents all converged on the same architecture: a handful of tools (shell execution, file read/write, code interpreter) wrapped in a "harness" — the scaffolding of system prompts, tool definitions, and orchestration that turns an LLM into an agent.

Five ways an agent can go wrong.

A sandbox without egress control is security theater.

Threat #2 is the most dangerous because most agents need the network — to install packages, fetch documentation, call APIs. The question isn't whether to allow network access, but how to control it:

The industry is converging on domain allowlists as the practical standard. And secrets should never enter the sandbox at all — Deno Sandbox pioneered an approach where code sees only placeholders, with real values injected only at approved hosts.

Now we know what we're defending against. What's been built to stop it?

Give each workload its own kernel. Boot it in 125ms.

Written in Rust by AWS, open-sourced December 2018. A single-process VMM using Linux KVM with radical minimalism: five emulated devices, ~50K lines of Rust versus QEMU's ~2M of C. The jailer wraps every VM in six defense layers: chroot, cgroups, namespaces, seccomp-bpf, unprivileged UID, and network namespace. Even if an attacker escapes the VM, they face all of these.

Rewrite Linux in Go. Let nothing reach the real kernel.

Google's Sentry reimplements 274 of ~350 Linux syscalls in memory-safe Go. No syscall passes directly to the host — the Sentry needs only ~68. A separate Gofer mediates filesystem I/O. nvproxy enables CUDA on H100, A100, T4, and L4. Go eliminates buffer overflow and use-after-free by construction.

The rest of the landscape.

Kata 3.x added runtime-rs (async Rust) and Confidential Containers (SEV-SNP). Cloud Hypervisor adds PCI hotplug and NVIDIA GPU passthrough. Wasm is structurally sandboxed but lacks threads until WASI 0.3.

How OpenAI and Anthropic layer their defenses.

Neither uses a single technology. Both independently converged on the same pattern: stronger isolation for hosted, lighter layering for local.

AWS enters: Firecracker microVMs for every agent session.

Amazon Bedrock AgentCore Runtime — serverless, framework-agnostic hosting for AI agents. Each user session runs in a dedicated Firecracker microVM with isolated CPU, memory, and filesystem. Supports sessions up to 8 hours, MCP and A2A protocols, and works with LangGraph, Strands, and CrewAI.

The wave behind them.

A broader convergence is underway: cloud dev environments are becoming agent sandboxes. Gitpod rebranded to Ona (Sep 2025). CodeSandbox was absorbed by Together AI (Dec 2024). Same DNA — fast provisioning, filesystem isolation, dependency management — different interface.

Don't boot. Restore.

This is the innovation that collapsed the sixty-year tradeoff. Instead of booting a fresh VM, platforms snapshot a fully-booted one with all dependencies, then restore using copy-on-write memory: pages are shared until written, so forking costs only memory for pages that actually change.

Security vs. speed? 0.79 milliseconds. Both. Anthropic showed this compounds: sandboxed execution with on-demand MCP tool imports reduces context tokens by 98.7% (150K → 2K).

We have the tools. How do you put them together?

The defense stack, mapped to the threats.

Firecracker's jailer combines all five: KVM → chroot → namespaces → cgroups → seccomp → privilege drop. OpenAI and Anthropic independently converged on this layered pattern — stronger for hosted, lighter for local.

Ephemeral, persistent, or both?

Three trends shaping what comes next.

What to use today.

In all cases: default-deny network egress. Domain-allowlisted proxy. Ephemeral environments when possible. Secrets never in the sandbox.

Three things to remember.

Match isolation to your threat model. Hardware VMs or user-space kernels are the minimum for multi-tenant hosted agents. Five runc CVEs in 2024–2025 validate this. For local agents, Landlock + seccomp works — as OpenAI and Anthropic both demonstrate.

Snapshot/restore broke the old tradeoff. From 500ms to 0.79ms. Security vs. speed is no longer a choice. This is the defining innovation.

Network isolation matters as much as compute isolation. A sandbox without egress control is security theater. Credential theft plus network access is the #1 real-world risk for coding agents.

Primary sources worth reading.