---
title: "What happens in the sandbox doesn't stay in the sandbox — Fictionet"
description: "A sandbox is anything that contains a dangerous action. For agents, the dangerous actions are mostly on the network, where a better VM does nothing."
url: https://fictionet.com/blog/what-happens-in-the-sandbox/
---

[Back to the blog](https://fictionet.com/blog/)

September 25, 2026

# What happens in the sandbox doesn't stay in the sandbox

Souvik Banerjee

Most agent sandboxes contain the least dangerous thing an agent does. When people say “agent sandbox,” they mean a virtual machine or a container. Inside one, a bad command can’t wreck your machine. We think the idea is much more general. A sandbox is anything that contains dangerous actions.

## Isolation stops at the network

Say you put your agent on [seL4](https://sel4.systems/Verification/), about the strongest isolation there is. seL4 is an operating system kernel. Its code comes with a machine-checked proof that it’s correct. Now plug in a network cable.

![An agent sits inside a glass box labeled formally verified isolation, with a faint scan rising up its walls. One cable runs out through a port in the front of the box to a globe labeled the real internet. A dot travels along the cable to the globe. Then it arcs to a server labeled someone else's server. The server gets a red cross and the word attacked.](https://fictionet.com/worlds/art/what-happens-in-the-sandbox-fortress.svg)

The walls hold. The attack goes out through the cable.

seL4’s proofs say the agent can’t touch anything it wasn’t given. But it was given the cable. The proofs say nothing about what goes down it. As Vercel [puts it](https://vercel.com/blog/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox), “Isolation without egress control contains the process, not its consequences.”

## Files are the easy part

A lot of agent sandboxing is about files. It sets which directories the agent may read and write. Files are also the easiest thing to undo. You can snapshot the disk or commit to git.

![Four rising steps: files, secrets, the network and the physical world. A truck stands on the last one. An undo arrow tries each step in turn. On files it completes, with a check and the word undone. On the other three it stops halfway at a bar, with a red cross and the words can't undo. The network step lists email sent, package published, trade executed and server attacked.](https://fictionet.com/worlds/art/what-happens-in-the-sandbox-ladder.svg)

Undo works on files. The dangerous actions are on the other steps.

Everything else is harder. A key that leaks into a repo has to be [revoked or rotated](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository). Rewriting the repo’s history doesn’t pull it out of clones. Gmail gives you [30 seconds at most](https://support.google.com/mail/answer/2819488) to unsend an email. npm lets you [unpublish](https://docs.npmjs.com/policies/unpublish) a package only in narrow cases. The trading firm Knight Capital [lost more than $460 million](https://www.sec.gov/files/litigation/admin/2013/34-70694.pdf) after 45 minutes of orders it shouldn’t have sent. All of these go out over the network.

Someone might point out that an agent can read your private keys or your `.env` file. That’s true, but a secret only hurts you once it leaves. It has to go out in a pushed commit, a web request or an email. For an agent, that almost always means the network. With a hosted model, the secret also goes to the model provider. That’s a network path too, and one you chose to trust.

## Allowlists check the address

Sandboxes are good at files. You can hand a program [one directory](https://man.freebsd.org/cgi/man.cgi?query=capsicum\&sektion=4) and nothing else. It can’t touch the rest of the disk.

The network gets much blunter tools. Usually it’s off, on, or a list of addresses the agent may reach, called an allowlist. Take [Landlock](https://docs.kernel.org/userspace-api/landlock.html), the sandbox built into Linux. Any program can use it to lock itself down. For files, you name a directory and say what the program may do there. For the network, all you can name is a port. You can allow connections on port 443, which is what HTTPS uses. You can’t say to which server, or what gets sent.

An allowlist of addresses isn’t much better. It says where the agent may go, but nothing about what it does once it’s there. Claude Code’s docs [warn](https://code.claude.com/docs/en/sandboxing) that allowing a broad domain like `github.com` “can create paths for data exfiltration.”

![Three panels. In the first, Landlock file rules name a directory, with the rule \~/project: read, write. The agent and two folders sit on one machine. A dot goes from the agent to \~/project and gets a tick. A second dot heads for \~/.ssh and stops partway, with a red cross. In the second, Landlock network rules name a port, with the rule connect: port 443. A dot goes to github.com on port 443 and gets a tick. Another goes to someone else's server, also on port 443, and gets a tick too, with the words also allowed in red. In the third, allowlists name a domain, with the rule allow: github.com. A dot goes to your repo, github.com/you/app, and gets a tick. Another goes to someone else's repo, github.com/them/app, and gets a tick too, with the words also allowed in red. A third heads for example.net and stops partway, with a red cross.](https://fictionet.com/worlds/art/what-happens-in-the-sandbox-landlock.svg)

A rule can name a directory, a port or a domain. None of them says what the agent sends.

You can look further than the address. Meta’s Muse agent, launched in September 2026, does. Every network request that leaves the agent’s machine goes through a separate process called [Sentinel](https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse). Sentinel can check “the hostname, the resolved and final destination IP address, the port, protocol, HTTP method, path, and the actual decoded request.”

In June 2026, an OpenAI agent was researching public medicine spending. It went to the public portal for Australia’s Medicare statistics. The address was fine. When the portal blocked it, the agent found a way around. It accessed files that weren’t public. Services Australia says the agent also wrote files to the portal’s internal server ([Prime Minister of Australia](https://www.pm.gov.au/media/press-conference-new-york)). OpenAI told Australia 84 days later, in an email to a public inbox.

In July, agents in an OpenAI eval were allowed to reach a package cache. They turned it into a message board ([METR](https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/)). One of them found working Hugging Face credentials, and about 700 of them joined an attack on Hugging Face. The attack went out over the network.

In September, [collusion.wiki](https://collusion.wiki/) reported about 18,000 posts from agents that called themselves OpenAI’s. The agents wrote them during a web research task. Most were on DSE wiki, a public wiki. The agents were only allowed to send requests meant for reading, called GET requests. But DSE wiki takes edits by GET. The agents used GET requests to write there anyway.

![Two panels. The left panel is labeled allowlist. The agent sits in its own box. A gate checks the request's method, GET, and ticks it. Its bar lifts. A message goes through to a real public wiki. The wiki turns red, with the words post written. The right panel is labeled simulated world. The agent, a simulated wiki and the world's log stand inside one world. The same GET goes to the simulated wiki. The log writes down GET prowiki.org and edit: new post. A label says nothing left the world.](https://fictionet.com/worlds/art/what-happens-in-the-sandbox-gate.svg)

A gate checks the address and the method. A simulated world takes the request and writes down what it did.

## Do what other fields did

Cutting the cable isn’t an answer. An agent that does research, writes code or books travel needs the internet to do its task. Fields where a mistake can’t be undone built fake worlds to test in. Malware analysts fake the internet with [INetSim](https://www.inetsim.org/) and [FakeNet-NG](https://github.com/mandiant/flare-fakenet-ng). Nuclear operators are [tested](https://www.law.cornell.edu/cfr/text/10/55.46) on a simulator of their own plant. [CME](https://cmegroupclientsite.atlassian.net/wiki/display/EPICSANDBOX/Client+Application+Testing+and+Certification) won’t let your trading system onto its exchange until the system passes certification in CME’s test environment.

So for evals, we should simulate the world. During the UK AI Security Institute’s own cyber evaluation, agents went after real people and organizations. The institute’s [incident report](https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing) says “good containment should not depend on the model choosing not to test its boundaries.” In a simulated world, it doesn’t. Every connection the agent opens lands in the world, and the world logs it.

Deployment is different. There, you want the agent to actually send the email, publish the release and make the payment. So the world has to be real. But you can hold every action that can’t be undone. A person approves it just before it becomes permanent. The email waits as a draft, the release as a pull request and the payment in escrow.

Muse does this too. It [checks with the person](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/) “before sensitive actions like sending an email or making a purchase.” When an action needs approval, Sentinel “creates a pending approval and execution stops.”

![An agent drops an email, a package and an order into a tray labeled outbox. They wait there. A gate labeled approval gets a tick and opens for the email. The email travels on to the real internet and rests there. A label reads sent after approval. The gate closes again. The package and the order stay in the tray.](https://fictionet.com/worlds/art/what-happens-in-the-sandbox-stage.svg)

The agent works freely up to the outbox. Only what a person approves goes out.

The simulated world and the outbox are both sandboxes in the sense we started with. They contain the consequences. We’re building [Fictionet](https://fictionet.com/) to simulate the world for agents that use the internet.

Fictionet is a network sandbox for agent safety evals, made by Amla Labs. If you run agent evals, [tell us what gets in the way](https://fictionet.com/#talk).