Tag

sandbox

6 entries, including 2 patterns.

1. 14 Sept

   An isolate is not a host boundary

   A V8 isolate or a NodeVM box can still leave the host process writable.

   • isolation
   • sandbox
   • agents
   • threat-model
2. Pattern9 Sept

   Sandbox Visibility Contract

   Establish which workload behaviours are observable, attributable and actionable inside an isolated agent runtime.

   • sandbox
   • detection
   • monitoring
3. 9 Sept

   The sandbox hid the workload

   Stronger isolation can change what host sensors observe. Validate workload detection as part of the sandbox design.

   • agents
   • sandbox
   • detection
   • monitoring
4. 5 Sept

   Sandbox on is not containment

   A sandbox label does not mean the agent is cut off from the estate. If the host can reach the VPN and the cloud APIs, so can the agent.

   • agents
   • sandbox
   • threat-model
   • network
5. Pattern5 Sept

   Verified Agent Containment

   A control pattern for security architects and platform teams who run coding agents or MCP-backed tools on shared hosts. It replaces the comfort label “sandbox on” with an explicit, checkable isolation boundary so the agent cannot silently inherit the estate’s network paths and cloud identity.

   • agents
   • sandbox
   • credentials
   • threat-model
   • network
6. 31 Aug

   Loopback is not a trust boundary

   Binding an unauthenticated model API to every interface is not loopback. The sandbox can still hold while the agent is owned.

   • inference
   • network
   • sandbox