A Clean Filesystem, Every Run.
Each run starts from a known state. Mount only what the task needs, and nothing the Agent writes touches your machine.
- Scoped, read-only mounts
- Explicit file in / file out
- No leftover state between runs
AGENT SANDBOX
SandBase Agent Sandbox
Give your Agent an isolated workspace to run code and handle files. Sandboxes start in seconds; retrieve the outputs you need before the environment is destroyed.
- Open source, MIT
- Model-neutral
- Self-hostable
$ sandbase sandbox create --egress api.github.com ✓ sandbox ready in 1.2s (non-root, fs: /work) $ agent> pip install pandas && python clean.py ✓ wrote /work/out/report.csv $ agent> curl https://unknown-host.io ✗ blocked by egress policy $ sandbase sandbox export out/ && destroy ✓ 1 artifact saved · sandbox destroyed
Illustrative session · no live execution or measured timing.
WHY SANDBOX
Sandbox Every Agent Run.
Make Mistakes Cheap.
Agent code was written seconds ago by a model, from inputs you don't control. A sandbox treats every run as hostile until proven otherwise — without slowing the Agent down.
Egress You Decide.
Deny by default and allow the domains the job needs. The most effective guard against leaked keys and data.
- Deny-by-default egress
- Per-run allowlists
- Credentials injected, never prompted
Destroyed After Use.
One run, one room. When the work is done, the sandbox is gone — keep only the artifacts you choose.
- Starts in seconds
- Non-root by default
- Persistent sessions only when you ask
COMPARE
Not a Cloud PC.
Not Just Docker.
Same building blocks, built for a different user — and an agent sandbox is the only one that assumes its user runs unreviewed code, unattended, at scale.
| Capability | Cloud PC | Virtual Machine | Docker | Agent Sandbox |
|---|---|---|---|---|
| Built for | People | Ops & engineers | Developers | AI Agents |
| Lifetime | Long-lived | Long-running | Long-running | Seconds, disposable |
| Trusts the code? | Yes | Yes | Yes | No — hostile by default |
| Interface | A screen | Machine + shell | Machine + shell | An API |
| Agent semantics | — | — | — | Sessions, egress, audit, metering |
PRODUCT VS CHASSIS
Build Your Own Agent,
Not Rent Someone's.
Finished "AI computer" products sell a worker plus its machine, tied to one vendor. SandBase sells the execution layer you're missing when you build your own.
The Car
- Persistent 24/7 workstation
- Sold to people who want work done
- Locked to one model vendor
- Hosted only
The Chassis
- Disposable by default, sessions on demand
- Built for developers shipping AI products
- Model-neutral, with a store of models & APIs
- MIT, self-hostable
WHERE IT FITS
The Layer That Turns
Sandboxes into Agents.
Isolation is becoming a commodity. The difference is in sessions, credentials, audit — and a direct line to the models and tools your Agent uses.
- L1AI computer productsGrok Bot · ChatGPT agent · Manus · Devin
Finished digital workers with persistent workstations, tied to one model vendor.
- L2Sandbox infrastructureE2B · Daytona · Modal · Cloudflare · Vercel
Headless execution layers for developers, priced by compute.
- L3Harness as a productSandBase Harness · OpenAI Agents API
The loop connecting models, tools, sessions and sandboxes — now a product.
- L4Isolation technologyFirecracker · gVisor · containers
microVMs, gVisor and containers. Essential, and increasingly a commodity.
Persistent Bash sessions
Credential management
Audit & replay
Built-in console
USE CASES
Who Runs Agents
in a Sandbox.
Three teams, one pattern: give every Agent run a sandbox, and keep the blast radius at zero.
Run the Code Your Agent Writes for Users
Give every end-user request its own room, so one bad generation never reaches another customer.
Self-Host Agent Execution on Your Own Infra
MIT-licensed Harness with credential management and audit replay, inside your network and residency rules.
Let Local AI Tools Act Without Risking Your Laptop
Point Codex, Claude, Cursor or Kiro at a sandboxed session instead of your home directory.
SECURITY BY DEFAULT
Honest About the Boundary.
A sandbox is only as safe as its defaults. The working directory is not a boundary, and a prompt is not a security control — these four are.
Sandboxed filesystem
Mount only what's needed. Assume anything writable can be destroyed.
Restricted egress
Allow specific domains; block everything else.
Disposable containers
One run, one environment. Carry out only chosen artifacts.
Non-root execution
Drop privileges so a compromised process has little to use.
FAQ
Sandbox Questions.
Everything teams ask before they run an Agent sandbox in production.
What is an agent sandbox?
An isolated, disposable environment where an AI Agent can write files, run commands and install packages without affecting your machine, network or data. It is created by API, used for a run, then destroyed.
Isn't Docker enough?
Containers share the host kernel and are not locked down by default. A sandbox adds egress policy, non-root execution, file transfer, sessions, audit and metering on top of containers or microVMs.
Persistent or disposable — which should I use?
Default to disposable. Turn on persistent sessions only for work that truly needs state, like a long build or an interactive shell. Sessions stay isolated and audited.
Can I self-host it?
Yes. SandBase Harness is MIT-licensed and local-first, so you can run it on your own infrastructure.
Which models and tools can my Agent use?
The Harness is model-neutral. Through its MCP bridge it connects to many AI clients and to the SandBase store of models and APIs with one key.
Is the working directory a security boundary?
No. The working directory and prompt instructions are not security controls. Use a sandboxed filesystem, restricted egress, disposable containers and a non-root user in production.
How is it priced?
Start free with starter credits, then pay for the Model, API and runtime work your runs use. Teams can talk to us about Scale.
FROM THE BLOG
What Is an Agent Sandbox? A Practical Guide for Teams Building AI Agents
How a sandbox differs from a cloud PC, a VM and Docker, how the 2026 market is layered, and what safe defaults look like.