Key points
- Agent = Model + Harness. Harness Engineering (Fikayo Adepoju) frames an AI agent as an LLM plus six surrounding scaffolding layers: Filesystem, Code Execution, Sandboxing (Episode 10 focus), Memory & Search, Context Management, and Observability. Sandboxing is the first and hardest security gate; if it fails, the other five become decorative.
- Why bare-metal execution is unacceptable. LLMs emit nondeterministic outputs. An agent asked to write a Python script may embed a covert exfiltration call; an agent asked to fix a DB bug may execute
DROP TABLE. Traditional Code Review cannot catch probabilistic errors, only physical isolation can. - 2026 industry consensus on sandboxing. Anthropic states the goal of a sandbox is not to make the agent trustworthy but to shrink the blast radius. NVIDIA AI Red Team mandates three controls: restrict outbound network, block workspace escape, and prevent the agent from tampering with its own MCP configuration (self-modifying harness = self-escalating privilege).
- Isolation technology comparison.
- Firecracker microVMs as the 2026 baseline. Each sandbox runs its own kernel with hardware isolation. Used by E2B, Vercel Sandbox (GA January 2026), Northflank, and Docker Sandboxes (per-VM Docker daemon to fix container-escape and Docker-in-Docker issues).
- DeltaBox: stateful sandboxing frontier. A May 2026 paper (arXiv 2605.22781) introduces incremental checkpoint/restore with fork primitives, raising GPU utilization from ~26% toward saturation on 7B model RL training. Sandboxes become stateful, forkable, and rollback-capable rather than disposable.
- Network namespace isolation. Default-deny:
--network=none; outbound restricted by allow-list of specific domains/ports; no access to internal private subnets unless explicitly proxied. Examples: E2B enforces timeouts at sandbox creation; Cloudflare Lockdown Mode makes Firecrawl's/scrapeserve cached results only, blocking prompt-injection-driven live egress. - Limits of isolation. Per Anthropic: isolation cannot prevent all threats. Data exfiltration remains a live risk even with outbound filters; writable mounts still permit code changes from read-only sandboxes; no sandbox stops a poisoned system prompt from reaching the API. Sandboxing reduces blast radius, not the explosion itself.
- Dynamic credentials and PII redaction. The harness never injects real production secrets into agent context. When the agent needs DB access, it requests short-lived (e.g., 10-minute) credentials from a vault (HashiCorp Vault) with least-privilege scope (e.g., UPDATE-only on specific rows). Logs and business data are redacted (phone, national ID, email →
*or synthetic test data) before entering context. - Worked example: fixing a production DB row. 1. Harness spins up a fresh Docker/Firecracker sandbox with only a DB client; host is invisible. 2. Harness requests a temporary, UPDATE-only credential valid for 10 minutes; network policy limits egress to a specific DB proxy port. 3. Agent generates and runs SQL inside the sandbox;
- 2026 sandbox selection decision tree.
- JS/TS only → Wasm/Edge.js (lightest, no virtualization)
- macOS local dev → Apple Container (native, VM-level isolation)
- Linux server:
- Low threat (internal tools, trusted users) → Docker + resource limits
- Medium threat (multi-tenant, untrusted input) → Firecracker / E2B
- High threat + extreme concurrency → Firecracker / E2B + pre-warmed pool
- Underlying philosophy.** Treat the sandbox as a design-time constraint, not a runtime check. Sandbox exists before the agent starts, network allow-lists are configured before the first request, ephemeral credentials are minted and TTL-bound before the agent sees them, and teardown is automatic on completion. Every unit of agent capability demands two units of harness hardness.
- Harness Engineering Episode 10, Fikayo Adepoju (Maven platform)
- ai-boost/awesome-harness-engineering — https://github.com/ai-boost/awesome-harness-engineering
- Agent Harness for Large Language Model Agents: A Survey, preprints.org, 2026-04-07
- AI Agent Sandboxing: Isolation Patterns for 2026, digitalapplied.com, 2026-05-17
- DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback, arXiv 2605.22781, 2026-05-21
- Practical Security Guidance for Sandboxing Agentic Workflows, NVIDIA AI Red Team
- 10 Best Code Execution Sandboxes for AI Agents (2026), fast.io
- Sandboxed Environments for AI Coding: The Complete Guide, bunnyshell.com, 2026-03-17
| Technology | Startup | Memory overhead | Isolation | Fit | |---|---|---|---|---| | Process | ~10 ms | +0 MB | None | Prototypes only | | Docker/OCI | ~1 s | +10–50 MB | Namespace | Trusted internal tools | | gVisor | ~2 s | +50–100 MB | User-space syscall interception | Security-sensitive | | Firecracker microVM | ~125 ms | +5–15 MB | Hardware virtualization | Production multi-tenant baseline | | WebAssembly | ~10 ms | +1–5 MB | Capability model | Compute-restricted tasks |
Docker shares the host kernel, so a kernel-escape compromises the host. Not acceptable for multi-tenant or untrusted input.
DROP TABLE is rejected by locked-down privileges.
4. Sandbox is destroyed; temporary credential auto-expires. Defense in depth: the agent cannot do harm even if it wanted to.
Practical heuristic: if the sandbox is breached, what is the worst case? Single-task impact → container is sufficient. Cross-tenant data exposure → microVM required. Public exposure with motivated attackers → microVM + careful ZeroBoot maturity assessment.