An agent sandbox is a restricted execution environment: inside it, an agent can read and write files, run commands, and reach specified network resources, but everything it can touch is decided by the sandbox boundary, and anything beyond that boundary is blocked. It is not a psychological suggestion added to the agent; it is isolation at the operating-system or virtualisation level. The key to understanding a sandbox is not the label “very safe” but exactly which things it isolates.
Three things a sandbox usually isolates
The first is the file system. An agent inside the sandbox can only see the working directory assigned to it; the host machine's other files are out of sight, so the damage from an accidental deletion or edit stays contained. The second is processes and resources. The sandbox limits which programs the agent can start and how much CPU and memory it may use, so one runaway task cannot drag down the whole machine. The third is the network. Many sandboxes are offline by default or only allow addresses on a whitelist, so the agent cannot send data out at will. Google's newly launched agent compute environment follows this idea: each agent gets its own isolated computer, the task runs in the isolated environment, and only the result comes back.
Three things a sandbox cannot stop
A sandbox controls what an agent can touch, not what it believes. If a file, web page, or email the agent reads hides an injected instruction, the agent may follow it within what the sandbox permits — for example, sending files from its working directory to some address. A sandbox also cannot stop permissions that are far too generous: if someone puts an entire project directory and all secrets into the sandbox, the isolation becomes a formality. More subtle still is signal leakage at the hardware level; researchers have already demonstrated ways to carry data out of an isolated environment via shared hardware signals, so a sandbox on its own is not a universal lock.
When to trust it, and when not to
Using a sandbox as the default is right: let the agent run in the isolated environment first, grant only the directories, network access, and keys it needs under least privilege, and leave critical actions for a human to confirm. Relying on the sandbox alone to cover everything is wrong: keep sensitive directories out, screen content from suspicious sources first, and always review actions involving money and accounts by hand. The value of a sandbox is that it shrinks the blast radius of an accident; it does not make the judgement for you.
