Agent Sandbox

What is an Agent Sandbox?

An agent sandbox is a secure, isolated environment in which an AI agent executes code and tool calls. The agent's reasoning loop, the harness, decides what to do; the sandbox is where the doing happens: cloning a repo, running a script, opening a document, compiling a project. Because the code an agent writes or runs is effectively untrusted, the sandbox keeps it away from the host system, from other agents and from anything it has not been explicitly allowed to reach.

Early sandboxes mapped one agent to one container or micro VM. Platforms such as Modal now run several containers inside one sandbox, so the harness can live in one container and tool calls can execute in another, with a sidecar for things like a custom egress proxy.

Key Characteristics

• A full workspace - A coding agent needs the repo, dependencies and dev services; an accounting agent needs documents, work papers and scripts; all of it lives inside the sandbox.
• Persistence without compute - Filesystem or directory snapshots and shared volumes let an agent pause for days while waiting on a human, then resume without paying for idle machines.
• Elastic resources - Agent CPU and memory usage swings widely over a run, so sandboxes should grow and shrink rather than be sized for peak.
• Network and credential control - Allowed IPs, domains and increasingly specific paths, plus credentials injected so the agent never sees the secret it is using.
• Fast start and teardown - Workloads that create thousands of sandboxes per second need sub-second startup from snapshots.
• Observability - Logs, metrics and budget exposed to the agent as well as to humans, so the agent can diagnose its own failures.

Why Agent Sandboxes Matter

Agents fail in ways chat assistants cannot: they delete the wrong directory, exfiltrate a credential or spend an unbounded amount of compute. The sandbox is the control plane that makes those failures survivable, which is why companies running agents in production, from Ramp's internal coding agent to Basis's accounting agents, treat sandbox infrastructure as a product decision rather than a detail. Modal CTO Akshat Bubna argues it is also one of the few pieces of agent infrastructure a team should not build itself, because reliability under tail failures, continuous security hardening and scale are each full-time problems.

Related Reading

• Agent Harness - The reasoning loop that drives the sandbox
• Agent Observability - Seeing what agents do inside their environments
• Durable Execution - Resuming agent work after crashes and long waits