Tools · Agent sandboxing
AI agent sandboxes and code isolation tools
Coding agents and data agents write code and then run it. These products give that code an isolated place to run, from a disposable cloud machine or microVM to an operating-system sandbox on a developer's laptop, and limit which files, network destinations and credentials it can reach. A team needs one when agents run code they wrote or downloaded, because without isolation that code runs with the same access as the person or server that started the agent.
Agent sandboxing 8
-
Kubernetes SIG Apps
Open-source Kubernetes controller and Sandbox resource for isolated, stateful, single-pod workloads such as agent runtimes. It hands low-level isolation to runtimes such as gVisor or Kata Containers.
-
Cloudflare Sandboxes (vendor site, opens in a new tab)
generally availableRuns untrusted or agent-written code in Linux containers or isolated Workers, where the calling Worker decides which APIs and data the code receives and whether it can reach the internet. Requires the Workers Paid plan; the container option uses a scheduling policy Cloudflare marks as public beta.
-
Daytona (vendor site, opens in a new tab)
generally availableCreates isolated sandboxes for running AI-generated code through SDKs for Python, TypeScript, Ruby, Go and Java.
-
E2B (vendor site, opens in a new tab)
generally availableGives each AI agent an isolated machine to run code, browse and use tools, in E2B's cloud or the customer's AWS, GCP or Azure account. The core is open source.
-
Modal Sandboxes (vendor site, opens in a new tab)
generally availableModal
Isolated, disposable sandboxes for coding agents and reinforcement learning rollouts, started from any container image.
-
OpenShell (vendor site, opens in a new tab)
generally availableNVIDIA
Open-source runtime that runs each agent in an isolated sandbox where kernel controls limit file access and system calls and every network connection is checked against a declared policy. Agents never see real credentials, which OpenShell adds only to requests bound for approved endpoints, and policy changes that would widen access wait for human review.
-
Anthropic
Open-source tool that enforces filesystem and network restrictions on agents, local MCP servers and shell commands at the operating system level, using macOS sandbox-exec or Linux bubblewrap plus a proxy-based network allowlist, without a container.
-
Vercel Sandbox (vendor site, opens in a new tab)
generally availableVercel
Runs AI-generated, customer or other untrusted code in ephemeral Firecracker microVMs, each with its own filesystem and network.
Recent launches
- NVIDIA OpenShell Reference Architecture · generally available
- Perplexity SPACE (open source) · generally available
- Runlayer network access policies for Runlayer Agents · generally available
- NVIDIA Open Agent Safety Platform (OpenShell and Sentry) · generally available
Announced in the last 90 days. Each launch on New tools links the vendor's own announcement.
The briefing
New AI agent governance tools, by email
The briefing's New Tools section covers the latest governance launches, each linked to the vendor's announcement, next to the news that decides which ones matter. At least once a week, five-minute read, free.
You confirm by email. Unsubscribe in one click.
Questions to ask vendors
Neutral questions for a request for proposal (RFP) or a security questionnaire. No product here is named as the answer.
-
What is the isolation boundary: a container, a user-space kernel such as gVisor, a microVM, or an operating-system sandbox? What does the sandbox share with the host?
-
Show us the egress policy, not an assurance. Is outbound access denied by default, and what is on the allowlist?
-
Can the agent inside the sandbox change or switch off its own sandbox settings, and is any such change logged?
-
Where do credentials live, and can code inside the sandbox read them?
-
What persists between runs, and how is a sandbox destroyed when a run ends?
More questions, grouped by topic: Questions to ask AI agent security vendors.
Related incidents
- A DeepSeek Harness flaw let an agent switch off its own file sandbox
- Claude Cowork could break out of its VM and reach any file on the Mac
- OpenAI Codex deleted users' home directories in full-access mode
- n8n patched a sandbox escape that ran OS commands as the n8n process
- Irregular's evaluation sandboxes leaked onto the live internet
Every record in the AI agent incident database links the sources that reported it.
Missing a product, or found an entry that is out of date? Write to [email protected]. A submission is read, never paid for, and does not guarantee a listing. The glossary defines the terms used here.