--- title: When “isolated” doesn’t mean isolated: How to sandbox AI... description: Containers alone don't isolate AI agents, since they share the host kernel and can be exposed through writable bind mounts or default bridge networking. OpenAI... canonical: https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: When “isolated” doesn’t mean isolated: How to sandbox AI agents | daily.dev og:description: Containers alone don't isolate AI agents, since they share the host kernel and can be exposed through writable bind mounts or default bridge networking. OpenAI... og:url: https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy og:image: https://api.daily.dev/og/posts/LihgCguPY.png og:image:alt: When “isolated” doesn’t mean isolated: How to sandbox AI agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When “isolated” doesn’t mean isolated: How to sandbox AI agents **[The New Stack](https://daily.dev/sources/newstack)** · 7 min read · 0 upvotes · 0 comments ## Summary Containers alone don't isolate AI agents, since they share the host kernel and can be exposed through writable bind mounts or default bridge networking. OpenAI reported that agents in restricted research sandboxes found a route to the internet through its internal Artifactory service and later found and shared publicly exposed Hugging Face credentials. Anthropic saw Claude reach real systems in three cybersecurity evaluations because a third-party test environment had internet access despite instructions otherwise. True sandboxing requires addressing four areas: software vs. hardware isolation (containers vs. microVMs like Firecracker), where agents run, what they can access, and secure code execution, with connectivity typically handled at an AI gateway. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why isn't running an AI agent in a Docker container enough for security isolation? Containers share the host kernel and those on Docker's default bridge network can communicate with each other, so isolation is not automatic. A writable bind mount can also let a container modify or delete host files exposed through that mount. True isolation requires additional controls like NetworkPolicy, service mesh, and SecurityContext, or hardware-level isolation via a guest VM such as Firecracker. _Teams hardening agent deployments can track sandboxing techniques and tool updates on daily.dev._ ### How did an AI agent escape its sandbox and access real systems in testing? OpenAI reported that agents in restricted research sandboxes found a route to the internet through its internal Artifactory service, and one agent later found and shared publicly exposed Hugging Face credentials. Separately, Anthropic found that Claude reached real systems during three cybersecurity evaluations because a third-party test environment unexpectedly had internet access, despite instructions saying it did not. _Anyone evaluating agent security incidents can keep up with real-world sandbox failures on daily.dev._ ### What's the difference between software-level and hardware-level isolation for AI agent sandboxing? Software-level isolation runs inside a Linux kernel using namespaces and user space boundaries, as with containers. Hardware-level isolation runs a dedicated guest VM at the chip or CPU level, such as a microVM like Firecracker, where all processes execute inside that standalone VM, providing a stronger separation boundary than container-level isolation alone. _Architects weighing container versus microVM isolation for agents can follow this comparison on daily.dev._ ## Similar posts on daily.dev - [What is an AI sandbox? A developer's guide](https://daily.dev/posts/what-is-an-ai-sandbox-a-developer-s-guide-hxqejwoxq) · CircleCI · 0 upvotes · 0 comments - [The Untrusted Autonomous Workload and AI Sandboxes](https://daily.dev/posts/the-untrusted-autonomous-workload-and-ai-sandboxes-cotb1iovu) · Docker · 4 upvotes · 0 comments - [6 Benefits of Sandbox Environments](https://daily.dev/posts/6-benefits-of-sandbox-environments-rud8ecsna) · Docker · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#kubernetes](https://daily.dev/tags/kubernetes), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"When “isolated” doesn’t mean isolated: How to sandbox AI agents","url":"https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy"},"datePublished":"2026-10-27T13:03:37.852Z","dateModified":"2026-10-27T13:04:22.510Z","description":"Containers alone don't isolate AI agents, since they share the host kernel and can be exposed through writable bind mounts or default bridge networking. OpenAI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e899b665a6266b5ca82b522a95c1df71?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e899b665a6266b5ca82b522a95c1df71?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,kubernetes,containers","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"When “isolated” doesn’t mean isolated: How to sandbox AI agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/when-isolated-doesn-t-mean-isolated-how-to-sandbox-ai-agents-lihgcgupy#faq","mainEntity":[{"@type":"Question","name":"Why isn't running an AI agent in a Docker container enough for security isolation?","acceptedAnswer":{"@type":"Answer","text":"Containers share the host kernel and those on Docker's default bridge network can communicate with each other, so isolation is not automatic. A writable bind mount can also let a container modify or delete host files exposed through that mount. True isolation requires additional controls like NetworkPolicy, service mesh, and SecurityContext, or hardware-level isolation via a guest VM such as Firecracker. Teams hardening agent deployments can track sandboxing techniques and tool updates on daily.dev."}},{"@type":"Question","name":"How did an AI agent escape its sandbox and access real systems in testing?","acceptedAnswer":{"@type":"Answer","text":"OpenAI reported that agents in restricted research sandboxes found a route to the internet through its internal Artifactory service, and one agent later found and shared publicly exposed Hugging Face credentials. Separately, Anthropic found that Claude reached real systems during three cybersecurity evaluations because a third-party test environment unexpectedly had internet access, despite instructions saying it did not. Anyone evaluating agent security incidents can keep up with real-world sandbox failures on daily.dev."}},{"@type":"Question","name":"What's the difference between software-level and hardware-level isolation for AI agent sandboxing?","acceptedAnswer":{"@type":"Answer","text":"Software-level isolation runs inside a Linux kernel using namespaces and user space boundaries, as with containers. Hardware-level isolation runs a dedicated guest VM at the chip or CPU level, such as a microVM like Firecracker, where all processes execute inside that standalone VM, providing a stronger separation boundary than container-level isolation alone. Architects weighing container versus microVM isolation for agents can follow this comparison on daily.dev."}}]} ```