Definition
An execution environment that enforces boundaries around files, processes, networks, credentials, devices, and other resources. Agent sandboxes let untrusted or uncertain code perform useful work while reducing what a mistake or compromise can reach.
A sandbox may use containers, virtual machines, operating-system isolation, language runtimes, browser boundaries, or combinations of them. The label is incomplete without the policy: which paths are readable and writable, which processes can start, which hosts are reachable, what credentials exist, whether privilege escalation is possible, how long state persists, and what artifacts may leave.
Containment is one layer
A sandbox limits consequences; it does not prove code or output is correct. Network access can still enable exfiltration. Mounted credentials can still authorize damaging calls. Shared caches and artifact stores can carry contamination across runs. Escape vulnerabilities can defeat the boundary. Pair isolation with least privilege, egress control, trusted images, patching, monitoring, provenance, and verification of promoted artifacts.
Distinguish it from nearby terms
An ephemeral environment is short-lived. A sandbox is access-controlled. Either can exist without the other. A worktree isolates Git changes but usually shares the host process, network, and credentials, so it is not a security sandbox by itself.
Check your understanding
An agent runs in a container with the host's cloud credentials mounted and unrestricted internet access. Is it meaningfully sandboxed for a prompt-injection threat? Its process boundary may be isolated, but its valuable authority is not. Evaluate the credentials, network, mounts, output channels, and escape path.