--- title: Kilo Sandbox: Run auto-mode without holding your breath description: Kilo Sandbox is a new OS-level confinement feature for the Kilo AI coding assistant that restricts what an agent can do while running in auto-mode. It limits... canonical: https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kilo Sandbox: Run auto-mode without holding your breath | daily.dev og:description: Kilo Sandbox is a new OS-level confinement feature for the Kilo AI coding assistant that restricts what an agent can do while running in auto-mode. It limits... og:url: https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c og:image: https://api.daily.dev/og/posts/laRjgbL1C.png og:image:alt: Kilo Sandbox: Run auto-mode without holding your breath og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kilo Sandbox: Run auto-mode without holding your breath **[Kilo Blog](https://daily.dev/sources/kilo-ai-blog)** · 5 min read · 1 upvotes · 0 comments ## Summary Kilo Sandbox is a new OS-level confinement feature for the Kilo AI coding assistant that restricts what an agent can do while running in auto-mode. It limits filesystem writes to the workspace and optionally blocks network egress via an authenticated proxy, without restricting reads. On macOS it uses Seatbelt/sandbox-exec; on Linux it uses Bubblewrap, seccomp, and network namespaces. Windows is not yet supported. The feature is configurable globally or per project via kilo.jsonc, and can be toggled per session. It explicitly does not prevent data exfiltration via model responses or cover SSH/SOCKS traffic, but is designed to reduce blast radius when running autonomous agents at full speed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Kilo Sandbox restrict what an AI coding agent can do in auto-mode? Kilo Sandbox uses OS-native process confinement, restricting the agent to writing only inside the workspace or explicitly allowed paths, always keeping .git read-only, and optionally blocking network egress except to an allowlisted set of hosts inspected via TLS SNI. Reads remain unrestricted. It uses Seatbelt on macOS and Bubblewrap plus seccomp on Linux; Windows is not yet supported and fails closed instead of falling back to unrestricted execution. _For teams weighing AI agent safety tradeoffs, daily.dev surfaces how sandboxing approaches like this actually work under the hood._ ### What did OpenAI's GPT-5.6 Sol model change for AI agent security? GPT-5.6 Sol, released by OpenAI, is described as its strongest cybersecurity model yet, improving multi-step planning, tool use, and long-horizon execution without human oversight. This raises risk in mixed-model agent pipelines, where a more capable orchestrator model could persuade a smaller subtask model into running commands it would not have proposed on its own, or be influenced by a poisoned README. _Developers tracking frontier model capability jumps can follow their security implications for coding agents on daily.dev._ ### Why doesn't sandboxing an AI coding agent prevent data exfiltration through prompts? Sandboxing restricts writes and network egress but leaves reads unrestricted by design, so the agent still sees the full codebase, docs, and dependencies. Anything the model reads can leave through its own responses, meaning prompt-based exfiltration is not blocked by filesystem or network confinement; Kilo Sandbox is explicitly described as not a privacy boundary. _Anyone hardening AI agent workflows can weigh these security tradeoffs through coverage on daily.dev._ ## Similar posts on daily.dev - [Sandboxing AI agents in Linux](https://daily.dev/posts/sandboxing-ai-agents-in-linux-8gbhps1vs) · Hacker News · 0 upvotes · 1 comments - [What is an AI sandbox? A developer's guide](https://daily.dev/posts/what-is-an-ai-sandbox-a-developer-s-guide-hxqejwoxq) · CircleCI · 0 upvotes · 0 comments - [SkyPilot Sandboxes: Run Agent Code on Your Own Kubernetes, at Scale](https://daily.dev/posts/skypilot-sandboxes-run-agent-code-on-your-own-kubernetes-at-scale-q6ldvrf5n) · SkyPilot · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kilo Sandbox: Run auto-mode without holding your breath","url":"https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c"},"datePublished":"2026-07-14T20:36:52.096Z","dateModified":"2026-09-13T20:28:52.500Z","description":"Kilo Sandbox is a new OS-level confinement feature for the Kilo AI coding assistant that restricts what an agent can do while running in auto-mode. It limits...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a3ee87945cbca5967952234665563a30?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a3ee87945cbca5967952234665563a30?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Kilo Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Kilo Blog","logo":"https://media.daily.dev/image/upload/s--x3pmrf8D--/f_auto,q_auto/v1774964071/logos/kilo-ai-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/kilo-ai-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Kilo Blog","item":"https://daily.dev/sources/kilo-ai-blog"},{"@type":"ListItem","position":3,"name":"Kilo Sandbox: Run auto-mode without holding your breath"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kilo-sandbox-run-auto-mode-without-holding-your-breath-larjgbl1c#faq","mainEntity":[{"@type":"Question","name":"How does Kilo Sandbox restrict what an AI coding agent can do in auto-mode?","acceptedAnswer":{"@type":"Answer","text":"Kilo Sandbox uses OS-native process confinement, restricting the agent to writing only inside the workspace or explicitly allowed paths, always keeping .git read-only, and optionally blocking network egress except to an allowlisted set of hosts inspected via TLS SNI. Reads remain unrestricted. It uses Seatbelt on macOS and Bubblewrap plus seccomp on Linux; Windows is not yet supported and fails closed instead of falling back to unrestricted execution. For teams weighing AI agent safety tradeoffs, daily.dev surfaces how sandboxing approaches like this actually work under the hood."}},{"@type":"Question","name":"What did OpenAI's GPT-5.6 Sol model change for AI agent security?","acceptedAnswer":{"@type":"Answer","text":"GPT-5.6 Sol, released by OpenAI, is described as its strongest cybersecurity model yet, improving multi-step planning, tool use, and long-horizon execution without human oversight. This raises risk in mixed-model agent pipelines, where a more capable orchestrator model could persuade a smaller subtask model into running commands it would not have proposed on its own, or be influenced by a poisoned README. Developers tracking frontier model capability jumps can follow their security implications for coding agents on daily.dev."}},{"@type":"Question","name":"Why doesn't sandboxing an AI coding agent prevent data exfiltration through prompts?","acceptedAnswer":{"@type":"Answer","text":"Sandboxing restricts writes and network egress but leaves reads unrestricted by design, so the agent still sees the full codebase, docs, and dependencies. Anything the model reads can leave through its own responses, meaning prompt-based exfiltration is not blocked by filesystem or network confinement; Kilo Sandbox is explicitly described as not a privacy boundary. Anyone hardening AI agent workflows can weigh these security tradeoffs through coverage on daily.dev."}}]} ```