--- title: A sandbox without a network boundary is only half a sandbox description: Running untrusted code in a microVM provides compute isolation but leaves a critical gap: unrestricted network access. Without egress control, sandboxed code... canonical: https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A sandbox without a network boundary is only half a sandbox | daily.dev og:description: Running untrusted code in a microVM provides compute isolation but leaves a critical gap: unrestricted network access. Without egress control, sandboxed code... og:url: https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft og:image: https://api.daily.dev/og/posts/7PbsBjpfT.png og:image:alt: A sandbox without a network boundary is only half a sandbox og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A sandbox without a network boundary is only half a sandbox **[Vercel](https://daily.dev/sources/vercel)** · 8 min read · 0 upvotes · 0 comments ## Summary Running untrusted code in a microVM provides compute isolation but leaves a critical gap: unrestricted network access. Without egress control, sandboxed code can still exfiltrate data, probe internal services, or relay credentials to external servers. A complete sandbox requires both compute isolation and network boundary enforcement. Vercel Sandbox addresses this with a host-level firewall that intercepts outbound TCP and DNS traffic, enforces domain and CIDR-based policies, and injects credentials at the network boundary so they never enter the microVM. Policies can be granular (allow one AI provider, one storage bucket, one API path) and can change dynamically during a workload's lifecycle. A programmable proxy layer allows custom authorization, audit logging, and supply-chain scanning. The full egress firewall is available on all Vercel Sandbox plans, including Hobby. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can untrusted code escape a microVM sandbox through the network without breaking the VM boundary? Yes. Untrusted code inside a microVM does not need to break the kernel or VM boundary to exfiltrate data or receive instructions. A single uncontrolled network path — an open DNS resolver, a misconfigured allowlist, or an unrestricted outbound TCP connection — is sufficient. The VM boundary can remain fully intact while the sandbox still fails to contain the code's consequences. _Teams shipping AI agent sandboxes track egress control patterns and real-world bypasses on daily.dev._ ### How does Vercel Sandbox prevent credentials from being stolen by code running inside the sandbox? Vercel Sandbox injects credentials at the host network boundary rather than placing them inside the microVM. The firewall creates a per-sandbox certificate authority just in time, selectively terminates TLS for configured destinations, adds or replaces the authentication header, then establishes a new TLS connection upstream. The credential never enters the microVM and is scoped to specific destinations, paths, methods, and headers — so malicious code cannot copy it elsewhere. _Developers building multi-tenant code execution environments find credential isolation architecture discussions on daily.dev._ ### How can I change the network policy of a Vercel Sandbox while it is still running? Vercel Sandbox supports dynamic policy updates via `sandbox.update({ networkPolicy: 'deny-all' })` or any other policy object, without restarting the workload. This allows a workflow to start with package registry access, narrow permissions before untrusted code runs, briefly permit an output destination, and then cut all outbound access — all within a single sandbox lifecycle. _Developers designing least-privilege execution pipelines for AI agents share patterns like these on daily.dev._ ## Similar posts on daily.dev - [Full Sandbox egress firewall now available on Hobby plan](https://daily.dev/posts/full-sandbox-egress-firewall-now-available-on-hobby-plan-mclpbbq2p) · Vercel · 0 upvotes · 0 comments - [Vercel Sandbox tutorial: run untrusted code safely](https://daily.dev/posts/vercel-sandbox-tutorial-run-untrusted-code-safely-ycdiv657b) · Flavio Copes · 1 upvotes · 1 comments - [The Untrusted Autonomous Workload and AI Sandboxes](https://daily.dev/posts/the-untrusted-autonomous-workload-and-ai-sandboxes-cotb1iovu) · Docker · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A sandbox without a network boundary is only half a sandbox","url":"https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft"},"datePublished":"2026-08-10T21:00:11.689Z","dateModified":"2026-08-10T22:44:09.301Z","description":"Running untrusted code in a microVM provides compute isolation but leaves a critical gap: unrestricted network access. Without egress control, sandboxed code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4c2193a3270965e52bc325ceaaa4d54?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4c2193a3270965e52bc325ceaaa4d54?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Vercel","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Vercel","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/04cca7235cf84db092f24b7ba427b3e1","url":"https://daily.dev/sources/vercel"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,vercel","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Vercel","item":"https://daily.dev/sources/vercel"},{"@type":"ListItem","position":3,"name":"A sandbox without a network boundary is only half a sandbox"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-7pbsbjpft#faq","mainEntity":[{"@type":"Question","name":"Can untrusted code escape a microVM sandbox through the network without breaking the VM boundary?","acceptedAnswer":{"@type":"Answer","text":"Yes. Untrusted code inside a microVM does not need to break the kernel or VM boundary to exfiltrate data or receive instructions. A single uncontrolled network path — an open DNS resolver, a misconfigured allowlist, or an unrestricted outbound TCP connection — is sufficient. The VM boundary can remain fully intact while the sandbox still fails to contain the code's consequences. Teams shipping AI agent sandboxes track egress control patterns and real-world bypasses on daily.dev."}},{"@type":"Question","name":"How does Vercel Sandbox prevent credentials from being stolen by code running inside the sandbox?","acceptedAnswer":{"@type":"Answer","text":"Vercel Sandbox injects credentials at the host network boundary rather than placing them inside the microVM. The firewall creates a per-sandbox certificate authority just in time, selectively terminates TLS for configured destinations, adds or replaces the authentication header, then establishes a new TLS connection upstream. The credential never enters the microVM and is scoped to specific destinations, paths, methods, and headers — so malicious code cannot copy it elsewhere. Developers building multi-tenant code execution environments find credential isolation architecture discussions on daily.dev."}},{"@type":"Question","name":"How can I change the network policy of a Vercel Sandbox while it is still running?","acceptedAnswer":{"@type":"Answer","text":"Vercel Sandbox supports dynamic policy updates via `sandbox.update({ networkPolicy: 'deny-all' })` or any other policy object, without restarting the workload. This allows a workflow to start with package registry access, narrow permissions before untrusted code runs, briefly permit an output destination, and then cut all outbound access — all within a single sandbox lifecycle. Developers designing least-privilege execution pipelines for AI agents share patterns like these on daily.dev."}}]} ```