Learning Hub  ·  Sandboxing & agent security

Sandboxing AI Agents' Code and MCP Servers

AI coding agents write programs, run them, and install MCP servers across your machine and your infrastructure. Most of it is code no one reviewed.

It runs with your full access, so a single bad line can read your files, leak your secrets, or reach anything on your network.

Sandboxing your agent's code helps you move quickly and securely from prompt to production.

Understand

Why sandbox what your agents run?

An AI coding agent runs with your authority by design. It reads your repository, runs your toolchain, and reaches the network, because that is what makes it useful. You can narrow that a little, since some agents ship their own operating-system sandbox and you can run one in a VM. But a useful agent keeps broad access, and as Trail of Bits argues, even a VM won't reliably contain a sufficiently capable one, because it has to share the network and resources the agent can turn into an exit. So the boundary that holds is not around the agent. It is around everything the agent runs on your behalf, and what that code is allowed to reach.

A generated script with a subtle bug, an MCP server pulled from a registry, a tool that a prompt-injection attack redirected: each executes with the same broad access unless you contain it. Sandbox the code, and even a fully hijacked tool can only use the capabilities that tool was granted, so a compromised step reaches a dead end instead of your secrets.

Prompt injection turning a tool malicious
The tool still runs, inside a boundary that never had access to what the attacker wants.
Data exfiltration
A component with no declared network egress has nowhere to send what it reads.
Lateral movement
Each sandbox starts empty, with no path to its neighbors or the host.
TakeawaySandboxing your coding agent's output keeps the agent useful and puts the boundary around the code, tools, and MCP servers it runs.

Compare

Sandbox approaches compared

Containers, microVMs, and WebAssembly components all isolate. The difference is what that isolation costs at agent-traffic scale, where you may spin up a fresh environment per tool call.

Isolation granularitycoarse → fine-grained →
Traditional VM OS container MicroVMFirecracker IsolateV8 WebAssemblythis hub's lens
Guest OSFull OS, Linux or WindowsShared host kernelMinimal Linux kernelNone, shared JS engineNone, runtime engine
IsolationHardware, hypervisorSoftware, namespaces & cgroupsHardware, minimal VMMSoftware, V8 context & heapSoftware, capability sandbox
I/O & networkingEmulated hardware, heavy VirtIOHost bridge and NATMinimal VirtIOWeb APIs, fetch & socketsWASI system interface
Cold startsec–min~100s of ms≤125 ms<5 ms~0.2 ms
Densitytens per host~100s per node100s, per-VM memory1,000s1,000s–10,000s
Ideal workloadMonoliths, legacy apps, databasesStandard apps, dev environmentsMulti-tenant AI code executionEdge API services, web routingPortable plugins, distributed systems, per-call agent code

WebAssembly is this hub's lens: capability-based, a fresh sandbox per call. Its figures are our own measurements on wash-runtime; the microVM and isolate numbers are published Firecracker (≤125 ms) and Cloudflare Workers (<5 ms) figures.

A hardware VM draws a stronger wall than a software sandbox, but the wall is not the control that matters here. As Trail of Bits shows, even a VM won't contain a capable agent. What limits the blast radius is least authority: denying by default what the code can reach. That is the axis these rows don't show.

Cloud agent sandboxes such as E2B, Modal, and Daytona rent ephemeral environments in someone else's cloud, so your code and data leave your machine. Cosmonic runs the same capability model locally and on your own cluster, so the code stays where you are.

Compare all five approaches →

The model

How sandboxing AI-generated code works

The model is capability-based and deny-by-default. A component starts with no filesystem, no network, no clock, and no environment. It receives exactly the capabilities you declare, scoped per component. Outbound network exists only where you declared it, so a component allowed to reach api.github.com and nothing else cannot reach anywhere else, even if its code tries.

component github-pr-summarizer.wasm capabilities
net → api.github.com:443granted
net → * (all other hosts)denied
fs → /home, /etc, /var …denied
env → process environmentdenied

No ambient authority. No shared account, no inherited filesystem, no implicit network. Grants are explicit and reviewable before anything runs, and each invocation starts from a fresh sandbox, so state cannot leak from one call to the next. This is the principle of least authority applied to code you didn't write. For AI-generated code, it is the difference between hoping a program behaves and not needing it to.

TakeawayEvery grant is explicit, per-component, and deny-by-default.

Answers

Common questions

"I'm building an AI agent that needs to safely execute code generated by LLMs. What sandboxing solutions should I consider?"
Consider where the code should run (your machine, your cluster, or a rented cloud sandbox), how precisely you can scope its access, and what a fresh environment per call costs. For local and on-prem work with per-component egress control, a capability-based Wasm sandbox keeps the code and data with you.
"How do I set up a deny-by-default policy so an agent's code must ask before reading a file or calling a tool?"
Start every component with no capabilities, then grant each filesystem path and network host explicitly. Anything not granted is denied, and grants are visible before the code runs.
"What is the right sandboxing architecture for an AI code-execution agent, including boundaries and privilege model?"
Keep the orchestrating agent outside the boundary, since it holds host authority by design, and put every artifact it runs inside its own least-authority sandbox, scoped per component, fresh per invocation.

Go deeper

Explore the topics

/mcp-security/Sandboxing MCP servers →The security model for running MCP servers your agent installs, contained.
how-toSandboxing AI-generated codeRun the code an agent writes, including Claude Code's output, with least authority.Coming soon
how-toSandboxing a Kafka MCP serverSandboxed messaging: a Kafka MCP server that reaches only the brokers you declare.Coming soon
referenceAI agent securityWhere sandboxing fits in the broader picture of running agents safely.Coming soon

Reference

What is an AI sandbox?

An AI sandbox is an isolated execution environment for code you can't fully trust: programs an LLM generated, tool calls, and MCP servers. Inside it, that code runs with only the capabilities you granted and nothing else. It is not a sandbox for the model or the agent themselves. It is a sandbox for the artifacts they produce and the tools they invoke.

What goes inside one is the code your agent runs: a script it wrote, an MCP server it installed, a tool it called. What each is allowed to reach, whether a filesystem path, a network host, or an environment variable, is declared and granted explicitly. Everything else is denied by default.

That is what separates it from a scratch environment or a dev container. The point isn't a throwaway place to experiment. It is a boundary you can see and trust, so you can run code you didn't write without reading every line of it.

FAQ

Frequently asked

Can you sandbox an AI agent itself? +
To a point. Some coding tools ship an OS-level sandbox and you can run an agent in a VM, but a useful agent keeps broad access. The durable boundary is around the code, tools, and MCP servers it runs.
How is WebAssembly sandboxing different from containers? +
Containers share the host kernel and expose a broad syscall surface. WebAssembly components run in a shared-nothing, capability-based sandbox, so each one starts with no ambient authority and reaches only what you granted.
Does sandboxing add latency to agent workflows? +
A fresh WebAssembly component instance starts in about 0.2 ms on our own measurements, so a fresh sandbox per invocation is practical at agent volume. A component's first-ever start also compiles it once, adding a few tens of milliseconds.
Can I run it on my existing Kubernetes cluster? +
Yes, through Cosmonic Control: CRDs and an operator, added to the cluster you already run.