sandbox
A closed, secure environment where a program or AI agent can work and make mistakes without accessing the rest of your machine or your data.
In plain terms
In a playground sandbox, a child can build and destroy anything because the sand stays within the frame and causes no harm in the garden. A computer sandbox does the same with programs: they are given a fenced-off area where they can work freely but cannot reach outside.
This is needed because not every program can be trusted. An unknown email attachment, a website's code or an AI-written program may be faulty or malicious. If it runs in a sandbox, the damage stays inside the sandbox.
Because of AI agents, the sandbox is more important today than before. An agent not only writes text but also runs commands, modifies files, and opens websites. If it misunderstands something or is deceived by a hidden instruction on a website, the sandbox determines how much damage it can cause.
Therefore, a sandbox does not make the program smarter or more reliable. It restricts what it can access, so the consequences of an error are smaller.
How it works
- The system creates an isolated environment: this can be a separate virtual machine, a container, or a process strictly restricted by the operating system.
- Predefined rules specify what is allowed inside: which folders the program can see, whether it can write files, whether it can access the internet, and if so, which addresses.
- The program or agent works inside it, and every outgoing request goes through a checkpoint that rejects prohibited actions.
- If more permissions are needed for the task, the sandbox simply denies the operation. Many AI tools stop in such cases and ask for your permission, so you decide on risky steps.
- At the end of the task, the sandbox can be discarded or reset: only what you explicitly release, such as the final file, comes out.
An everyday example
You ask an AI assistant to analyze an Excel spreadsheet and draw a chart from it. The AI writes and runs a program for this, but not on your machine: it runs in an isolated sandbox that contains only the uploaded spreadsheet. If the program is faulty, it can cause damage only within the sandbox and cannot access your other files.
Who is affected
A common misconception
Limits and risks
- The sandbox is only as good as the strictness of its rules: if you allow everything for convenience, the protection is lost.
- It does not protect the data you let in: if the agent is given both internet access and a confidential file, a deceptive instruction could cause it to leak them.
- The stricter the sandbox, the more tasks get stuck on permission requests, so you must always weigh security against convenience.
- The sandbox itself is software, so it can contain bugs, and there are known attacks specifically targeting escape (sandbox escape).
Similar, but not the same
- regulatory sandbox – This is not a technical but a legal tool: companies can develop and test new solutions under regulatory supervision and within controlled frameworks before entering the market, for example under the EU AI Act. It does not grant exemptions from laws.
- guardrails – The guardrail regulates what the model can say or do, while the sandbox defines what the running program can technically access.
- test environment – The purpose of the test environment is to try things out without live data, while the sandbox provides isolation and is also used during live work. In everyday usage, the test environment is often called a sandbox (for example, a payment system's trial interface).
Related concepts
AI safety, cybersecurity, access control
container, virtual machine, code execution environment, browser sandbox
AI-agent, coding agent, prompt injection, safeguards, principle of least privilege
A brief history
The concept of isolated execution dates back to the chroot system call introduced in Unix in 1979. The term 'sandboxing' in this sense was popularized by Robert Wahbe and colleagues in a 1993 study. Later, it became a fundamental security solution for browsers and mobile operating systems.
Where things stand
Long a standard feature in browsers and phones. By the end of 2026, most AI assistants that run code and most coding agents also offer a sandbox, though the strictness of the settings varies greatly from tool to tool.
In the news
- Unofficial relay service disables sandboxes in OpenAI Codex and Claude CodeOct 29, 2026 · Code
- METR red team broke OpenAI's agent monitoring in three waysOct 26, 2026 · Code
- Docker, Pydantic AI and Google ship tools to run AI agents in isolated environmentsOct 21, 2026 · Code
- HKMA launches "ART" framework for responsible AI adoption in banking; banks test deepfake detectionOct 19, 2026 · Money
- Ping An Digital Bank reaches 96% deepfake detection accuracy in HKMA GenAI sandboxOct 15, 2026 · Money
- GitHub Copilot comes to Windows with local models and sandboxed tools; what goes to the cloud is unclearOct 7, 2026 · Code
- FCA publishes good and poor practice on AI; Mills Review examines future of retail financeOct 5, 2026 · Money
- Utah lets AI prescribe acne medication without direct physician oversightOct 5, 2026 · Health
Also known as
sandbox · sandbox · sandboxing · sandbox environment · isolated runtime environment · isolated environment · sandbox environment · sandboxing
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.