dful.
Dful Dark
Theme
Browse notes
On this page

Sandboxing & Egress

Which resources code executed by an agent can reach and what it can send out: filesystem, runtime, credentials, and egress.
Updated 6 Oct 2026

Agent permissions decide whether an action may start. Sandboxing controls what its execution can reach once it starts, while egress limits how the process can communicate outside the environment.

The distinction matters because a legitimate action can execute unexpected code. Authorizing npm test does not make every dependency, script, or subprocess launched by the tests trustworthy.

Execution boundary

An execution boundary can limit:

  • Which parts of the filesystem are visible and writable.
  • Which host processes and interfaces are available.
  • Which credentials and environment variables enter the runtime.
  • Which sockets, devices, or other resources cross the isolation boundary.
  • Which outbound network connections can be initiated.

The useful control is the one that still applies when the executed process tries to do something different from the operation implied by the original tool call.

Filesystem and path resolution

A coding agent normally needs read and write access to the workspace. That does not require exposing the user’s home directory, host configuration, or credential stores.

Read and write access need separate consideration. Preventing changes to ~/.ssh does not protect a private key if the process can still read it and has a channel through which to send it. A stronger boundary keeps the secret out of the environment: if the credential is never mounted or injected as an environment variable, sandboxed code cannot read it directly.

Restrictions also need to apply to the effective path. A file inside an allowed directory can be a symlink to a location outside it. A system that validates the apparent path before resolving the link can cross the boundary it intended to enforce.

The control should therefore resolve the real resource and then verify that it still belongs inside the permitted area.

Runtime isolation

The filesystem is only one part of the environment. A sandbox can separate processes, operating-system interfaces, and other host resources through OS mechanisms, containers, or virtual machines.

These choices provide different boundaries. A container normally shares the host kernel, while a VM can have its own kernel, filesystem, and process table. The concrete technology matters less than identifying which resources remain unreachable if an authorized command ends up executing arbitrary code.

Restrictions should apply to child processes as well. If npm test starts Node.js and Node.js launches another process, that child should not escape the same rules merely because it was not the original tool call.

Deliberate exceptions also need review. Mounting a host directory, exposing a privileged socket, or injecting a credential expands the effective surface of the sandbox.

Network egress

Egress is traffic initiated from the environment toward other systems. For an agent, this may be an HTTP request, a dependency connection, an API call, or any socket the process can open.

If a process can read a secret and has arbitrary network access, it does not need a tool named exfiltrate: Python, curl, a library, or a dependency can provide the channel. Network policy can deny access by default, allow selected destinations, or route traffic through a proxy that inspects the operation.

Allowlisted domains

Allowing a hostname still exposes the operations available at that service. One domain can support reads, writes, and uploads associated with different accounts.

Anthropic documented a case where api.anthropic.com had to be allowed for the product to function. Malicious content used that authorized route to upload files to an attacker-controlled account. The issue was not that the hostname had been identified incorrectly; the policy did not distinguish the request and credential precisely enough.

Cases like this require looking beyond the allowlist and checking which effects remain available at each authorized destination.

Example: coding agent

Suppose an agent receives this task:

Run the repository tests and fix the failures.

The environment provides a read/write workspace, Bash, required dependencies, and network access to the project’s registry. The user’s home directory and GitHub credentials remain outside the sandbox.

Execution reach and network egress npm test starts and a compromised subprocess executes inside the sandbox workspace. The execution boundary blocks access to host resources, while a separate egress interface reaches the required registry and blocks an attacker-controlled destination. Sandbox Workspace / repository npm test Authorized execution Subprocess Compromised dependency Host resources ~/.ssh and user credentials Egress Controlled interface Registry Required destination External destination Attacker-controlled blocked reachable blocked Execution reach and network egress npm test starts and a compromised subprocess executes inside the sandbox workspace. The execution boundary blocks access to host resources, while a separate egress interface reaches the required registry and blocks an attacker-controlled destination. Sandbox Workspace / repository npm test Authorized execution Subprocess Compromised dependency Egress Controlled interface Host resources ~/.ssh and user credentials Registry Required destination External destination Attacker-controlled blocked reachable blocked
Figure 1. Code runs inside the sandbox; the boundary limits local resources it can reach and egress policy restricts external destinations.

The agent correctly decides to run npm test, but a compromised dependency is loaded during execution and tries to read an SSH key, search environment variables for tokens, and send any secrets to an external server.

The model does not need to make a bad decision for this scenario to matter. Security depends on what the process can reach:

  • If $HOME is not exposed and credentials never entered the runtime, those secrets are unavailable.
  • If some sensitive data is readable but the external destination is blocked, the outbound channel is missing.
  • If readable data and arbitrary egress are both available, the authorized execution has an exfiltration path.

The sandbox also constrains code the agent legitimately executes as part of a task: tests, builds, scripts, and dependencies should remain inside the same boundary.

A prompt injection can manipulate which action the model requests, and permissions can decide whether that action starts. Sandboxing and egress cover the next step: what the authorized execution can actually do.

References