Sandboxer
What is an AI agent sandbox?
An AI agent sandbox is a separate, isolated computer where an agent can run commands, install software and use tools without touching your own machine, accounts or other users. A good one has its own kernel, holds only the secrets a task needs, limits what it can reach, and can be paused, copied or thrown away.
Updated October 28, 2026
Why do AI agents need a sandbox?
Agents need a sandbox because they act like developers, and developers make changes that can break things. A coding or computer-use agent runs shell commands, adds dependencies, starts servers and reads web pages. On a laptop or a production server, every one of those actions has full reach.
Sandboxer's guide to agent sandboxes names two main risks:
- Mistakes. A wrong delete command, a bad migration or a runaway process damages whatever the agent can touch.
- Untrusted input. Text hidden in a web page, an issue or a file can steer the agent through prompt injection, and the agent then acts with all of its permissions.
A sandbox keeps that damage inside a machine that holds nothing else of value.
What should a good agent sandbox have?
A good agent sandbox combines a strong boundary with a complete working environment. The table below lists the properties Sandboxer's guide highlights and how a Sandboxer sandbox meets each one.
| Property | Why it matters | In Sandboxer |
|---|---|---|
| Isolation | A shared kernel is a larger attack surface | One Cloud Hypervisor microVM per sandbox, with its own kernel |
| Secrets | An agent can only leak what it holds | --no-env starts with none of your secrets |
| Network reach | Limits what a misled agent can contact | No direct route to other sandboxes or internal networks; outbound internet is open |
| A full OS | Real tasks need packages and services | Ubuntu 24.04, sudo, systemd, Docker, /dev/kvm |
| Lifetime | Long tasks should not die halfway | Stop saves memory, and a stopped sandbox costs nothing |
| Disposable | Start clean and discard after | Delete when done, or fork to try again |
Is a container enough, or do you need a VM?
For untrusted or agent-written code, a virtual machine with its own kernel is the stronger choice. Containers share the host's kernel, so a kernel bug or a mounted Docker socket can let code escape. gVisor adds a user-space kernel in between. A microVM uses hardware virtualization, so each sandbox runs its own kernel.
Containers are lighter and still better than running an agent on your laptop. The trade-offs are covered in microVMs vs containers.
What should never go inside an agent sandbox?
Keep out anything you would not hand to the agent's worst possible input. That includes your SSH keys, long-lived cloud credentials, production database access and personal browser sessions. Pass only short-lived, narrowly scoped keys for the task at hand.
Sandboxer supports this with no-secret sandboxes and scoped API keys. Details are in security and isolation.
How do you give an agent a Sandboxer sandbox?
You can hand a task to an agent that runs inside the sandbox, or let your own agent create sandboxes as tools. The first approach takes three commands:
curl -fsSL https://sandboxer.com/install | sh
sbx new --no-env -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"
sbx prompt <sandbox-id> --provider claude-code "Clone the repo, run the tests, fix what fails"For the second approach, connect an MCP client such as Claude, Claude Code, Codex or Cursor to Sandboxer's MCP server. The agent then gets tools to create sandboxes, run commands, move files, publish a port and stop the machine when it is done.
Frequently asked questions
What is an AI sandbox?
An isolated environment where AI-generated code or an AI agent can run without access to your own computer, data or credentials. It can be a container, a gVisor sandbox or a virtual machine.
Is a Docker container a safe sandbox for an agent?
It is safer than your laptop, but containers share the host kernel. For untrusted code, a microVM with its own kernel is a stronger boundary, and the host's Docker socket should never be mounted into an agent's container.
How long should an agent sandbox live?
As long as the task needs. Short code runs can use throwaway sandboxes, while coding agents often need hours or days, which is where stop and resume with memory helps.
Can my own agent create sandboxes?
Yes. Use the REST API at https://sandboxer.com/api/v1 from any language, or connect any MCP client to Sandboxer's MCP server.