Sandboxes Will Become Standard Agent Infrastructure

A model that answers questions mainly creates information risk. An agent that executes commands also creates system risk: it can delete files, expose tokens, install malicious dependencies, or obey instructions planted in external content.

A sandbox puts execution inside declared boundaries. Writable paths, process resources, reachable networks, and credential lifetimes should be decided before a task starts rather than left to model self-restraint.

Codex uses isolated cloud environments, while Firecracker, gVisor, and container security practices offer different isolation tradeoffs. Products will combine mechanisms by risk level instead of discovering one universal sandbox.

A useful sandbox controls at least files, processes and system calls, outbound networking, secret injection, and time or resource budgets. Isolating one dimension while leaving another unlimited is not a complete boundary.

Recovery matters as much as prevention. Start from a snapshot, preserve a diff of writes, and destroy the environment after completion so work can be reviewed, reverted, or replayed without guessing what changed.

Isolation should not become an opaque failure mode. When an action is blocked, the product should explain why and offer the smallest temporary permission that unblocks the step. “Allow everything” defeats the model.

Standardization will emerge at the declaration layer: required tools, mounts, network domains, secrets, and resources described once and implemented by different runtimes. Agent tasks need a portable execution manifest.

Cheap, fast, observable sandboxes will let organizations run thousands of tasks with bounded consequences. Like TLS or containers, this unglamorous layer will become a default assumption behind trustworthy agent products.