The sandbox: where agents run, and what they can touch

Micro-VM — strongest

Container — standard

Process — light

Agent code

× no stray credentials× no open egress

In plain terms

You don’t let a new contractor rewire the building on day one. You give them a workshop: real tools, real materials, and walls — a place where mistakes are cheap and contained. That’s a sandbox.

An AI agent that writes and runs code is taking real actions on real computers. Most of the time those actions are exactly what you wanted. The design question is about the other times — and the grown-up way to ask it is not “will the agent misbehave?” but “when something goes wrong, how far can it spread?” That distance is the blast radius, and it’s a choice you make in architecture, not a hope you place in the model.

The anatomy

Isolation comes in layers, and the trade-off is always strength versus weight. Process isolation is the lightest: the agent’s code runs in a restricted process (sandboxed interpreters and similar) — fast to start, fine for quick untrusted snippets, weakest walls. Containers are the workhorse middle: the agent gets its own filesystem and network namespace — good isolation at low cost, the default for most agent work. Micro-VMs are the strong end: hardware-level virtual machines that boot in milliseconds — the walls are close to physical, used where the code is most untrusted or the stakes highest.

Walls are half the story; the other half is what’s inside them. Scoped credentials: the sandbox holds only the keys this task needs — short-lived, narrow, revocable. Egress control: no network paths out except the ones the task requires; an agent that can’t reach a system can’t leak to it. And a full activity record, because “contained” still needs “explainable.”

One principle above all: the agent asking politely is not a security model. Instructions can be manipulated, and models can be confused. Boundaries have to be things the agent cannot cross, not things it agrees not to.

What good looks like

The blast-radius questions for any vendor whose agent executes code: Where does generated code run, exactly? What credentials exist inside that environment? What can it reach on the network? And if the agent did the worst thing its permissions allow — what, concretely, is the damage? Vendors with real answers love this question. The others change the subject.

Where Cortex stands

Blast-radius control is one quarter of Cortex’s determinism boundary: Policy decides what agents may do, Sandbox decides where they do it, Approvals put a human at the gates, and Audit records everything — with the logging pattern drawn from the Audit Vault. For the full deployment blueprint — identity, access, and data sovereignty — see our paper on deploying secure agentic systems.

Questions this paper answers

Why do AI agents need sandboxes? Because they execute real code with real permissions, and mistakes or manipulated instructions must stay contained. A sandbox makes the worst case small by construction instead of trusting the agent’s judgment.

What isolation levels exist for agent code? Three main rungs: restricted processes (light, fast, weakest), containers (the practical default), and micro-VMs (near-physical isolation for the highest-stakes execution). Serious systems match the rung to the risk.

What is blast radius in AI agent security? The scope of damage if an agent does the worst thing its permissions allow. It’s controlled with isolation walls, scoped short-lived credentials, and egress limits — not with instructions.