Agent Sandboxing: Execution Isolation for Tool-Using Agents

Originally published at Agent Sandboxing: Execution Isolation for Tool-Using Agents on smartgate.network.

A shorter version of "Agent Sandboxing: Execution Isolation for Tool-Using Agents" — the full piece lives at smartgate.network.

What the full piece covers

• agent sandboxing: the boundary that runs the code — An agent is a loop that decides, then acts, and most of what it decides is reversible: a search that returns the wrong page, a summary that misses a clause.
• agent sandbox: four isolation levels and what each one stops — "Is it sandboxed?" is the wrong question, because the word covers mechanisms with very different strength.
• ai agent sandbox: the boundary around one tool call — The second decision is scope: one sandbox per agent process, or one per tool call.
• sandboxed code execution: the thin wrapper at the boundary — Every sandboxed executor, whatever it is built on, arrives at the same shape: a method whose whole body hands a call to the primitive that actually runs, and returns the result.
• sandbox escape: the shapes that break the boundary — A sandbox escape does not usually begin with a clever model.
• llm sandbox: running model-authored code without trust — An LLM sandbox runs code the model wrote during a turn, and the model is a first-class untrusted author.
• mcp sandbox: isolating a server you did not write — An MCP server is a process that exposes tools to the agent, and it is frequently third-party code run on your infrastructure with your credentials in its environment.
• How SmartGate's gateway sits above the sandbox — SmartGate is not a sandbox, and it does not claim to be one.
• What our fetcher refuses, read from our own egress checks — "Sandboxing" for an agent is often used to mean two different things: constraining what code can do, and constraining where a tool is allowed to reach.
• How to get started — List what the code may touch, before choosing a runtime.
• Limitations — This page describes a boundary, and a boundary is only as strong as its configuration.
• Related reading in this cluster — This page owns execution isolation. The pages below own the adjacent questions, and the boundary above is built to compose with them: the centre page frames the attack surface, and the others own detection, identity, the propagation path, the model-level …

Read the full piece: Agent Sandboxing: Execution Isolation for Tool-Using Agents on smartgate.network.