sandbox

Least-privilege permissions

• Run the sandbox with minimal file access — Only grant the AI agent permission to access folders it genuinely needs (e.g., specific project directories). Block access to sensitive system areas, configuration files, and credential stores.
• Disable unused tools — If you don't need the browser feature, shell access, or VSCode editor, turn them off in the container settings. Fewer active features = smaller attack surface (fewer things that could go wrong).
• Rotate credentials frequently — Any secrets (passwords, API keys) should be provided temporarily and rotated often. Never store credentials inside the container; fetch them fresh each time the agent starts.
• Use separate containers per task type — Run different AI agents in different sandboxes instead of one mega-sandbox. If one agent is compromised, others remain isolated.

Network isolation

• Block outbound internet by default — The sandbox should not reach the public internet unless absolutely required for a specific task. Use firewall rules to allow only approved destinations (e.g., specific APIs your AI needs).
• Isolate from host network — Ensure the container cannot directly communicate with your host machine's network. Use Docker's default bridge network, not --net=host.
• Disable inter-container communication — If running multiple sandboxes, prevent them from reaching each other unless explicitly needed.
• Monitor DNS requests — Log all domain lookups the sandbox attempts. Unusual external domains may signal credential theft or data exfiltration.

Monitoring

• Log all shell commands and file operations — Record what the AI agent does (commands run, files accessed/modified). Review logs regularly for suspicious activity.
• Alert on credential-like patterns — Set up automatic alerts if environment variables, API keys, or passwords appear in logs, command output, or file modifications.
• Track container resource usage spikes — Sudden CPU, memory, or disk activity may indicate the container has been compromised and is performing malicious work (e.g., mining cryptocurrency or exfiltrating data).
• Enable audit logging on the host — Log all container lifecycle events (creation, deletion, restarts) and resource access attempts to detect unauthorized tampering.

Red flags to watch for

• Unexpected network connections — The sandbox suddenly connecting to unknown IP addresses or domains outside your approved list indicates possible data theft or command-and-control activity.
• Credential output in logs — If API keys, passwords, or tokens appear in visible logs, command history, or temporary files, assume they are compromised and rotate them immediately.
• Untracked file or permission changes — Files appearing in the container that the AI agent didn't create, or files with suddenly changed permissions, suggest a container breach.
• Agent behavior diverging from instructions — If the AI agent performs actions outside its intended scope (e.g., trying to access or exfiltrate data you didn't ask it to touch), stop execution immediately and investigate.