---
title: "Run agents in a sandbox · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox
id: AID-23
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 742
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run agents in a sandbox

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-23
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Run coding agents in an isolated environment, such as a container, a virtual machine or the agent's own sandbox mode.
- Check: From an agent session, try to read a file outside the project, such as `~/.ssh/id_ed25519`, and reach an unlisted host. Both fail.
- Risk: An account or system taken over
- How: Limit the agent to the project folder. Block network access by default, as [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md) says. Many agents ship a sandbox mode, so turn it on. Examples are `/sandbox` in Claude Code and `--sandbox workspace-write` in Codex. Then check its defaults, because some still let commands read keys in your home folder, and some cover only shell commands.

## Sources

- [Claude Code, configure the sandboxed Bash tool](https://code.claude.com/docs/en/sandboxing)
- [Claude Code security](https://code.claude.com/docs/en/security)

## Related rules

- AID-13 [Block dangerous actions with hooks](https://agentwranglers.se/playbook/ai-assisted-development/rules-the-agent-cannot-break/blocking-hooks.md) in AI-assisted development
- AID-73 [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md) in AI-assisted development
- AID-63 [Give every parallel agent its own working copy](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/parallel-agent-workspaces.md) in AI-assisted development
- APS-91 [Run code the model writes in a sandbox](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/sandbox-model-code.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)