Download Cosmonic Desktop (Beta)
Learning Hub  ·  Sandboxing & agent security

Learn to sandbox AI agents, tools, and code

Our Learning Hub provides resources for AI agent security: how to sandbox the elements of AI workflows effectively.

Last updated October 2026

The hub is organized into two sections:

  • Sandboxing: Explore strategies and practical guidance for sandboxing AI workflows, including agents, tools, and generated code. Start with How to choose an AI sandbox.
  • AI security: Learn the fundamental concepts underlying AI security and how they apply to your own workflows.
  1. 1

    Agents

    How to choose an AI agent sandbox →

    Learn how to leverage deny-by-default sandboxes for secure agentic workflows.

    The least authority curve. An amber curve traces what each kind of agent needs to do its job, from a general coding agent down to a single-purpose one; a purple curve traces what each sandbox allows, from a full VM down to a Wasm sandbox. The two meet where the sandbox fits the agent.
  2. 2

    Tools

    How to secure MCP servers →

    Your agent installs MCP servers written by people you have never met, and each one runs with whatever the agent can reach. Tool poisoning, prompt injection through a tool result, and token theft all land here. A contained server reaches only the hosts you grant it.

  3. 3

    Apps

    Compare sandbox approaches for AI agent code →

    Agents write whole programs now, and some of them run for months. Nobody reviewed that code, and you cannot review code that does not exist yet. This is the layer where the choice of boundary shows up as a bill: what you can pack per host, and how fast a fresh one starts.

AI security concepts

Learn the concepts underlying AI sandboxing and security.

Security principles

The 6 Principles of Secure Agent Platforms →

Security design principles for AI agents, from Saltzer and Schroeder to NIST, each tied to a real incident. Plus the principles matrix (PDF).

Capabilities

What are capabilities? →

Ambient authority, the confused deputy problem, and what it means to hand an agent one key instead of the whole ring.

Least privilege

The principle of least privilege for AI agents →

Why least privilege breaks down for agents, how least authority goes further, and the controls that enforce it.

Run your first sandbox

Public beta

Cosmonic Desktop runs this capability model on your own machine, free forever for personal use, with no account and no cloud. Grab a sandboxed MCP server, see exactly what it can reach before it runs, and wire it into your agent.

Download Cosmonic Desktop See what's in the beta
Cosmonic Desktop's Inspect view: a component's declared interfaces and network egress drawn out, with everything else denied by default.

Frequently asked

Do you sandbox the agent, its tools, or the code it writes? +
All three, and they are different boundaries. The agent layer applies when the harness itself compiles to a WebAssembly component, which starts with no ambient authority; a stock harness install stays behind an operating-system, container or VM boundary instead. Sandboxing its tools limits each MCP server to the hosts you grant it. Sandboxing what it builds contains programs nobody has reviewed. Doing one and not the others moves the problem rather than solving it: a well-restricted agent that hands generated code full authority has not gained much.
Does sandboxing add latency to agent workflows? +
A fresh WebAssembly component instance starts in about 0.2 ms on our own measurements, so a fresh sandbox per invocation is practical at agent volume. A component's first-ever start also compiles it once, adding a few tens of milliseconds.
Which languages can I sandbox? +
Cosmonic Desktop ships one-click templates for Rust, Go, and TypeScript, and any language that compiles to a WebAssembly component works. MCP servers use the Rust template today. The capability boundary is the same in every language, because it is a property of the compiled component, not the source.
Can I run an AI sandbox on my laptop? +
Yes. Cosmonic Desktop runs entirely on your own machine, with no account or cloud required, and it's in public beta now.
Can I run it on my existing Kubernetes cluster? +
Yes, through Cosmonic Control: CRDs and an operator, added to the cluster you already run.
Is it open source, and what stays free? +
Cosmonic Desktop is free forever for personal use. It runs on CNCF wasmCloud, the open source WebAssembly host, so the runtime that enforces the sandbox is open to inspect.
How do you secure an AI agent? +
Bound what it can reach rather than trying to predict what it will do. An AI agent's risk is its authority: it runs with your files, your tokens and your network because that is what makes it useful. Securing one means putting each part of the workflow behind a boundary that grants only what that part needs, and denying the rest by default, so a prompt injection or a poisoned tool reaches a wall instead of your SSH key.
What are the biggest security risks of AI agents? +
Prompt injection through content the agent reads, poisoned or malicious tools, credential and token theft, and unreviewed generated code running with the agent's full access. They share a root cause: the agent holds broad ambient authority, so any one of them escalates to everything it can reach. That is why the control that helps most is reducing authority, not detecting bad instructions.
Is it safe to use AI agents? +
It depends entirely on what you let them reach. An agent running with your full account is as safe as the least trustworthy instruction it encounters, which on a normal day includes web pages, issues and documents it was asked to read. An agent whose tools and generated code each run with a named, minimal grant is a far smaller problem, because a successful attack still lands inside a boundary you chose.