How Do AI Sandboxes and Containment Controls Work?

An AI sandbox is a restricted computing environment used to run a model or agent without giving it unrestricted access to the host system, internal services or the public internet. Sandboxing is useful, but it is only one part of containment.

Why one boundary is not enough

Capable agents can write code, call tools and combine small weaknesses. A virtual machine may isolate the operating system, yet a misconfigured network route, stored password or trusted helper service can still provide a path outside it. Containment therefore uses several controls that fail independently.

The main layers

• Compute isolation: disposable containers or virtual machines separate the agent from the host and are destroyed after a task.
• Network isolation: outbound connections are blocked by default, with narrow allowlists for approved destinations.
• Least privilege: credentials are short-lived and grant only the permissions required for the test.
• Monitoring: separate systems record tool calls, file access, network requests and configuration changes.
• Approval gates: consequential actions such as sending data, spending money or modifying external systems require human confirmation.
• Shutdown controls: operators can stop tasks and revoke credentials even if the model process does not cooperate.

How containment is tested

Red teams deliberately ask agents to find paths across the boundary. Some tests provide source code or vulnerability hints to reveal weaknesses quickly. That establishes whether a path exists, but it does not by itself measure how often a model would discover or use the path without assistance.

What success means

Containment cannot promise that escape is impossible. A stronger goal is safe failure: one mistake should not expose real data or systems, detection should be rapid, and operators should be able to recover without relying on the model's own compliance.