Sandbox
Also known as: sandboxing · isolated environment
A sandbox is an isolated space where an agent’s actions can’t reach your real system: its own filesystem, its own processes, no real network (or a filtered one).
- Broken code can’t delete your files.
- A bad
rm -rfdies in the box, not on your disk. - Typical implementations: containers, VMs, microVMs.
The default: if an agent can run code, it runs code *in a sandbox*. That's table stakes for code agents — the cost of a sandbox is tiny compared to one bad command outside it.