Sandbox
Also called Sandboxing · Isolated environment
An isolated place for the agent to run, such as a container, VM or restricted shell, so a bad action can't reach the rest of your machine.
A sandbox is a walled-off environment for the agent: a container, a virtual machine, a cloud session, or a shell whose filesystem and network access are restricted. Whatever the agent does in there stays in there. It can delete files, install packages and run scripts, and the worst case is a fresh sandbox rather than a lost afternoon. The harness still executes tool calls normally; the walls are around the process, not inside the model.
Sandboxing is what makes permissive permission modes reasonable. Without it, 'bypass permissions' means trusting a non-deterministic text generator with your home directory, your SSH keys and every credential in your shell. With it, the same setting is just a way to stop babysitting. The common mistake is a leaky sandbox: a container that mounts your real repo read-write and inherits your environment variables has walls with a door propped open.
Decide what the sandbox must not reach, then verify it can't. Production credentials, package publishing tokens and cloud accounts stay outside. Give the agent a copy or a worktree of the code, a scratch database, and network access only to what the task needs. For parallel AFK runs, one sandbox per agent keeps them from stepping on each other. Cloud-hosted agent sessions are sandboxes someone else maintains, which is most of their appeal.
- Claude CodeCloud sessions run in a fresh container per session; locally, an optional sandbox restricts filesystem and network access for Bash.
- CodexRuns commands inside an OS-level sandbox by default, with network off unless you allow it.
- AntigravityEach agent works in its own workspace, and security policies control what it may reach.
“I want three agents chewing through the migration backlog overnight.”
“Then put each one in its own sandbox with a throwaway database. Permissions wide open inside, no prod access, PRs at the end.”
“And the sandbox dies when the run ends?”
Course 01 puts every one of these terms to work: you install Claude Code, run the loop, and ship a real project — permission modes, compaction, hooks and all.
Start Course 01 →