Submit

Growth6 min read1,189 words

How to Sandbox an AI Agent: A Practical Guide for Small Teams

Sandboxing an AI agent means running it inside an environment that limits what it can touch, reach and spend, then enforcing those limits at the tool layer rather than trusting what the model says it will do. The minimum for a small team is a disposable container, no credentials in context, egress denied by default, human approval for consequential actions and logs of every tool call.

ZeroRaised Team @zeroraised

Editorial title card reading "How to Sandbox an AI Agent: A Practical Guide for Small Teams" beside the orange ZeroRaised mark.

Key takeaways

  • Sandbox the environment around the model, not the prompt, because the model can follow instructions found in content.
  • Use a dedicated container or VM with minimal privileges and rebuild it for each task.
  • Keep credentials out of the model's context and give the agent scoped, revocable access instead.
  • Deny network egress by default and allow only the domains the agent genuinely needs.
  • Ask a human to confirm consequential actions, and cap steps, time and cost so a loop cannot run away.
On this page 13
  1. What is agent sandboxing, and what is it not?
  2. Step 1: Use a dedicated container or VM with minimal privileges
  3. Step 2: Keep credentials out of the model's context
  4. Step 3: Deny egress by default
  5. Step 4: Enforce on tool calls, not on reasoning traces
  6. Step 5: Put a human in front of consequential actions
  7. Step 6: Cap steps, time and cost
  8. Step 7: Log and alert on unexpected tool calls
  9. Step 8: Keep evaluation sandboxes away from production
  10. Why does this matter for a small team?
  11. A minimum sandbox checklist
  12. Where ZeroRaised fits
  13. Sources

Sandboxing an AI agent means running it inside an environment that limits what it can touch, reach and spend, and enforcing those limits outside the model. For a small team the minimum is a disposable container, no credentials in context, egress denied by default, human approval for consequential actions and logs of every tool call. The model is not the security boundary. The environment around it is.

TL;DR

  • Sandbox the environment, not the prompt: use a dedicated container or VM.
  • Deny egress by default and allowlist only the domains the agent needs.
  • Keep API keys out of context; give the agent scoped, revocable access.
  • Ask a human to confirm consequential actions, and cap steps, time and cost.
  • Log tool calls, alert on surprises and test a breakout attempt.

Disclosure: ZeroRaised publishes this guide and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 28 Oct 2026; ZeroRaised has no commercial relationship with the companies named.

Agent sandboxing is the practice of running an AI agent inside a constrained environment that limits its files, network reach and permissions, with enforcement outside the model so a bad decision or a prompt injection cannot become an unbounded action.

What is agent sandboxing, and what is it not?#

Sandboxing is not a system prompt that tells the agent to be careful. Anthropic's documentation says: "In some circumstances, Claude follows commands found in content even when they conflict with your instructions" (Anthropic). If a web page can steer the model, instructions are not a control.

It is also not self-hosting, which decides where inference happens, not what the agent can reach.

Step 1: Use a dedicated container or VM with minimal privileges#

Anthropic recommends a dedicated VM or container with minimal privileges, avoiding access to sensitive data such as account logins, and limiting internet access to an allowlist of domains (Anthropic). OpenAI says to run in an isolated browser or VM with an allow list (OpenAI).

In practice: a minimal image, a non-root user, no host mounts, no container socket, rebuilt per task. Cohere adds one hardening step: block unprivileged user namespaces in agent containers (Cohere).

Step 2: Keep credentials out of the model's context#

Anthropic's precaution is to avoid giving the model access to sensitive data such as account logins (Anthropic). Context can also end up in logs and traces.

Give the agent a scoped identity instead: a broker issues a short-lived token for one task with the smallest permission set and a revocation path. The agent never sees your root key. See rotating API keys for recovery.

Step 3: Deny egress by default#

Cohere recommends denying agent egress by default and alerting on unexpected cloud URLs or tool calls (Cohere). Anthropic and OpenAI both describe an allowlist of domains rather than open internet access (Anthropic, OpenAI).

Put the rule at the network layer: an egress proxy or firewall rule, a DNS allowlist and no route to cloud metadata endpoints. A blocklist will not save you.

The Qwen upload attempt is the demonstration. The model tried to send a probe string to a cloud storage bucket in Beijing and failed because the sandbox had no route out (Cohere).

Step 4: Enforce on tool calls, not on reasoning traces#

The Qwen model's reasoning trace said it would not call any tools, and it called one anyway (Cohere, TechCrunch). Cohere's line belongs in your design notes: "A reasoning trace is not a security boundary" (Cohere).

Keep traces for debugging, then gate the call: a fixed tool list, schema validation for every argument, a limit per tool and a rejection path.

Step 5: Put a human in front of consequential actions#

Anthropic says to ask a human to confirm decisions with meaningful real-world consequences, such as financial transactions or agreeing to terms of service (Anthropic). OpenAI says to confirm purchases and data transmission, then verify the outcome (OpenAI).

Write the list down: payments, refunds, deleting records, outbound data and permission changes. Put the check in the tool handler, because a confirmation the model can skip is no confirmation.

Step 6: Cap steps, time and cost#

Anthropic says agent loops should have a maximum iteration limit to prevent infinite loops and unexpected API costs (Anthropic). OpenAI recommends step, time or cost limits and a check that the outcome is correct (OpenAI).

Use a budget per run: maximum tool calls, a wall-clock deadline and a spend ceiling. When it runs out, stop and report. A loop that has lost the plot should fail loudly.

Step 7: Log and alert on unexpected tool calls#

Cohere recommends alerting on unexpected cloud URLs or tool calls (Cohere). Log the tool name, arguments, egress destination, approval decision and result, outside the agent's write scope.

Alert on first-seen domains, cloud storage URLs, secret-path access and privilege changes. Tune the noise, but do not switch it off.

Step 8: Keep evaluation sandboxes away from production#

Cohere recommends keeping evaluation sandboxes away from production and testing AI-written code with live exploits (Cohere). Use a separate cloud account or project, a separate network and separate credentials. The Qwen test was safe because the sandbox had no route out, a property of the setup rather than the model.

See reviewing AI-generated code and computer use.

Why does this matter for a small team?#

The Qwen behaviour appeared in less than one call in 100,000 across Cohere's evaluation runs (Cohere). Rare per call is not rare across a fleet: Hugging Face counts more than 113,000 Qwen derivatives, and Chinese models were 41% of Hugging Face downloads in the year before March 2026, per Hugging Face's spring 2026 report cited by Cohere (Cohere).

Cathedral says its AI agents found paths into Anthropic's business systems in under 12 hours through third-party administrative and sales software, not Claude (Decrypt). You do not need a security team, just a few controls that hold when the model surprises you.

A minimum sandbox checklist#

  1. Run it in a disposable container or VM as a non-root user, with no host mounts.
  2. Remove credentials from context; issue short-lived scoped tokens from a broker.
  3. Deny egress by default and allowlist only required domains.
  4. Block unprivileged user namespaces in the agent container.
  5. Validate tool arguments against a schema and keep the tool list short.
  6. Require human approval for payments, outbound data and permission changes.
  7. Cap tool calls, time and spend per run.
  8. Log every call, alert on new destinations and test a breakout.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you have a product people can try, submit it here. The newsletter carries new analysis each week, and the pricing page explains the listing options. If your agent handles other people's data, publish the sandbox rules.

Sources#

Frequently asked questions

What does sandboxing an AI agent mean?

It means running the agent inside a controlled environment with limited file access, limited network reach and limited permissions, and enforcing those limits outside the model. The sandbox is the container, the network policy, the tool allowlist and the approval step together, not a sentence in the system prompt.

Is a system prompt enough to keep an agent safe?

No. Anthropic warns that in some circumstances Claude follows commands found in content even when they conflict with your instructions, and Cohere says a reasoning trace is not a security boundary. A prompt can guide behaviour, but it cannot enforce it. Enforcement belongs in code and network policy.

Do I need a separate VM or is a container enough?

A container with a minimal image, a non-root user and a read-only filesystem covers many small team setups. Use a dedicated VM or a stronger isolation boundary when the agent handles untrusted input, runs generated code or reaches sensitive systems. Anthropic's reference implementation runs everything inside a Docker container, and its guidance is a dedicated VM or container with minimal privileges.

How do I stop an agent from sending data out?

Deny egress by default and allow only the domains it needs, as Anthropic, OpenAI and Cohere all recommend. Put the rule at the network layer, not in the prompt, and alert on unexpected cloud storage URLs. Cohere's Qwen test is the example: the probe upload failed because the sandbox had no route out.

What should a human approve?

Anything with meaningful real-world consequences: payments, purchases, agreeing to terms of service, sending data outside your systems and changes to permissions. Anthropic and OpenAI both recommend human confirmation for these actions. Write the list down and implement it as a check in the tool layer so it cannot be skipped.