Sandboxing

An agent that can run code can run any code, including code a web page talked it into running. Sandboxing is the assumption that this will happen and the containment that makes it survivable — a bounded filesystem, no ambient credentials, a network policy, a timeout, and a way to throw the whole environment away.

The boundary that matters is capability rather than intent: an agent cannot leak a token it was never given, and no amount of prompting substitutes for that. The specific failure to design against is the confused deputy — the agent has legitimate authority and is induced to use it on someone else's behalf, which no filter on the model's outputs can catch because the action is one it is allowed to take.

Contain by capability: the reachable set of effects is the intersection of what the tools expose and what the environment permits, and only the second is enforceable. Every credential in scope enlarges that set for every prompt the agent will ever see, so the useful question is not whether an action is intended but whether it is reachable.