The latest articles on DEV Community by libracoder (@libracoder). https://dev.to/libracoder https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F185495%2F7fd9a789-70c6-4cc8-8b24-422ed2c3ec70.png https://dev.to/libracoder en libracoder Mon, 26 Oct 2026 21:37:19 +0000 https://dev.to/libracoder/why-is-everyone-suddenly-putting-ai-agents-in-a-box-2nbk https://dev.to/libracoder/why-is-everyone-suddenly-putting-ai-agents-in-a-box-2nbk <p>A year ago, AI coding tools suggested code. You read it and decided whether to run it.</p> <p>Now they run it. They install packages, execute tests, call APIs and open pull requests, while reading text from strangers: README files, GitHub issues, web pages. Usually with the same access as the engineer who started them.</p> <h2> What is an agent sandbox? </h2> <blockquote> <p><strong>Agent sandbox:</strong> a boundary around an AI agent that controls what it can read, run and reach.</p> </blockquote> <p>Inside the boundary, the agent can work freely: edit the project, run the tests, install what it needs. Outside it are the things it should never touch on its own: your SSH keys, your cloud credentials, other repositories, and most of the internet.</p> <h2> What changed </h2> <ul> <li> <strong>Before: AI suggests code.</strong> It writes, and a person decides what executes.</li> <li> <strong>Now: AI runs the code.</strong> A sandbox decides what it can read, run and reach.</li> </ul> <p>That shift is why agent sandboxes have gone from a niche security topic to something every team running agents needs to understand. A permission prompt on every command doesn’t scale: after the fortieth one, nobody reads them.</p> <h2> What this series covers </h2> <p>Starting Friday, two short parts a week. Each one stands on its own, with three diagrams:</p> <ul> <li>What an agent can reach without a sandbox, and how one poisoned README leaks your keys</li> <li>Why git worktrees aren’t isolation</li> <li>Containers, gVisor and microVMs, and what actually separates them</li> <li>The network wall, secrets, many agents at once, and a reference architecture to finish</li> </ul> <p>No vendor pitches. Just how it works. If there’s something you want covered, tell us and we’ll fold it in.</p> <h3> Series: Agent sandboxes, in diagrams (11 parts, 27 October – 3 December) </h3> <ul> <li> <strong>Intro:</strong> Why is everyone suddenly putting AI agents in a box? <em>(27 Oct, this post)</em> </li> <li> <strong>01:</strong> What your AI agent can reach without a sandbox <em>(30 Oct)</em> </li> <li> <strong>02:</strong> Git worktrees don’t isolate your AI agents <em>(3 Nov)</em> </li> <li> <strong>03:</strong> How strong is your AI agent’s sandbox? <em>(6 Nov)</em> </li> <li> <strong>04:</strong> Your laptop already has a sandbox for AI agents <em>(9 Nov)</em> </li> <li> <strong>05:</strong> How to stop AI agents leaking your data <em>(12 Nov)</em> </li> <li> <strong>06:</strong> Keep API keys out of your AI agent’s reach <em>(17 Nov)</em> </li> <li> <strong>07:</strong> Running many AI agents at once, without collisions <em>(20 Nov)</em> </li> <li> <strong>08:</strong> Throwaway sandboxes: why AI agents should start fresh <em>(24 Nov)</em> </li> <li> <strong>09:</strong> How cloud sandboxes for AI agents work <em>(30 Nov)</em> </li> <li> <strong>10:</strong> A reference architecture for sandboxing AI agents <em>(3 Dec)</em> </li> </ul> <p><em>Originally published on the <a href="https://blog.runkiri.com/posts/agent-sandboxes-intro/" rel="noopener noreferrer">Kiri Blog</a>.</em></p> ai security containers agents