Your Sandbox Shouldn't Keep Its Install-Time Network Access
AI agent sandboxes face a critical security gap: network policies are typically set at environment creation and persist unchanged, causing untrusted execution phases to inherit overly broad permissions from earlier setup phases Tensorlake's Sandboxes enable atomic, live egress policy swaps on running sandboxes without suspension or recreation, with enforcement occurring host-side rather than inside the guest network stack The update mechanism guarantees atomicity (no enforcement gap), failure co
62
Hot
72
Quality
68
Impact
Analysis
TL;DR
- AI agent sandboxes face a critical security gap: network policies are typically set at environment creation and persist unchanged, causing untrusted execution phases to inherit overly broad permissions from earlier setup phases
- Tensorlake's Sandboxes enable atomic, live egress policy swaps on running sandboxes without suspension or recreation, with enforcement occurring host-side rather than inside the guest network stack
- The update mechanism guarantees atomicity (no enforcement gap), failure containment (rejected policies leave previous rules intact), and explicit replacement semantics (updates replace rather than merge)
- A phased agent run model (install → fetch → execute → deliver → sealed) treats each phase as a distinct policy state, minimizing the attack surface for untrusted model-generated code
- The
allow_internet_accessflag's behavior is counterintuitive: when paired with a non-emptyallow_outlist, it controls DNS resolution rather than general egress, creating a common pitfall for practitioners
Why It Matters
This addresses a fundamental security architecture problem for AI agent deployments: the mismatch between static sandbox permissions and dynamic trust requirements during multi-phase workloads. For practitioners building agentic systems that execute untrusted code, this represents a practical path toward defense-in-depth without paying the setup and state-migration costs of environment recreation.
Technical Details
- Live policy replacement: Tensorlake's SDK exposes a single
sandbox.update(network=NetworkConfig(...))call that atomically swaps the entire egress policy on a running sandbox, with no window where old rules are removed and new rules are not yet enforced - Host-side enforcement:
NetworkConfigis enforced at the host level per sandbox, not within the guest's network stack; modifying routes or firewall rules from inside the sandbox has no effect without calling the same authenticated orchestrator API - Policy semantics: Updates are full replacements, not merges—every update must express the complete intended policy for that phase. The three states are: omit network (keep current), pass a
NetworkConfigobject (replace entirely), or passCLEAR_NETWORK_POLICY(restore unrestricted egress) - Field behavior matrix:
allow_internet_access=Truewith non-emptyallow_outcreates a default-deny outbound policy with DNS permitted to sandbox resolvers; setting it toFalsewith non-emptyallow_outblocks DNS unless resolver IPs are explicitly listed - Connection handling: The firewall is stateful—established and related connections survive policy swaps, meaning narrowing
allow_outdoes not retroactively terminate connections opened during earlier phases - Error handling taxonomy: Three distinct error types—
SandboxNotFoundError,RemoteAPIError(with status code and message), andSandboxConnectionError—require different retry strategies; 409 conflicts on terminated sandboxes can be recovered via restart within 48 hours
Industry Insight
- The phased policy model (install → fetch → execute → deliver → sealed) should become a standard pattern for agentic workloads; treating network policy as a first-class, phase-scoped resource rather than an environment constant is a necessary evolution for secure AI agent infrastructure
- Practitioners should audit existing sandbox implementations for the
allow_internet_access+allow_outinteraction pitfall, as the default-deny-with-DNS behavior is easily misread as "internet access controlled by the allowlist" when it actually means "allowlist plus DNS resolution" - The host-side enforcement architecture—where the control path remains external to the workload—should be a minimum requirement for any sandbox provider claiming phased security; internal policy enforcement creates a circular trust problem that undermines the entire model
Disclaimer: The above content is generated by AI and is for reference only.
Agent Security Deployment
Related Articles
The Second Half of the AI War: No Longer About Who Has the Strongest Model, But Who Can Use It
The Calls are Coming from Inside the Model: Investigating Probe-based Detection of Tool-Calling Errors in LLMs
Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap
OpenClaw Releases OpenClaw 2.0: Guided Model Setup, 575 ms Control UI Startup, and One Trust Boundary Per Gateway
[GitHub] tensorflow/tensorflow