What does it mean to sandbox an AI coding agent?

What it is

The page's core argument, not carried by the summary, is a specific failure mode: filesystem isolation and network egress isolation are each individually bypassable by the other, and the piece spells out exactly how. It also names the operational structure of the nx/s1ngularity attack (base64-encoded exfiltration into victims' own public GitHub repos, no C2 infrastructure needed) and gives a three-question audit checklist for evaluating any sandbox already in use.

How it works

Lock the filesystem but leave egress open: the agent reads whatever it's permitted to read and POSTs it out over the open network path. Lock egress but leave the filesystem open: the agent writes to a shell startup file or a hook, and something outside the sandbox executes that payload later — filesystem write becomes the exfiltration channel once network is closed. The page attributes this exact dependency to Anthropic's own sandboxing write-up. Separately, it notes containers get "perforated" in practice: mounting the project directory, forwarding git credentials, and passing through the SSH agent to make a container usable for real work reintroduces most of what was being isolated — and the same credential/mount exposure applies to VMs and microVMs too, since they still need the project directory mounted.

Preconditions / Affected

Applies to any org running Claude Code, Cursor, or Codex CLI (or similar agents) with live credentials (GitHub tokens, cloud roles, DB connection strings) reachable from the agent's workspace. The nx attack specifics: the malware used the agents exactly as documented with guardrails switched off — no vulnerability was exploited. At peak, 1,400+ exfiltration repos were publicly searchable on GitHub before takedown, and harvested tokens seeded a second wave renaming private repos to public.

What to do

The page gives a concrete three-question audit for any agent sandbox already deployed:

1. What is actually enforcing the isolation? (If nothing, it's configuration, not a sandbox.)
2. What did you put inside it? (If cloud credentials or the SSH agent are inside the boundary, the wall doesn't matter.)
3. Who can change it? (If the developer can switch it off, that's a default, not a control.)

It also states the diagnostic takeaway: almost every documented sandbox escape traced back to allowlist hygiene or configuration logic, not a novel exploit — meaning audits should focus there first.

Caveats

The page states guardrails and permission systems in harnesses have improved since August 2025, but explicitly argues these can't be relied on as a control because LLMs are non-deterministic and prompt injection has no foolproof fix — the next phrasing of a malicious request "may still land."