WTF is Agent Sandboxing?
Running agents in isolated environments with restricted privileges, so mistakes or attacks can't reach beyond the box.
Also called: sandbox, sandboxed agents
TL;DR
Assume the agent will eventually do something unexpected, through a bug, a bad plan or a prompt injection. A sandbox limits the blast radius: its own container or VM, only the files it needs, tight network rules, short-lived credentials.
How it works
Thoughtworks moved it to Adopt in Radar Vol. 35, extending it from coding agents to agents acting across business systems. Approach: threat-model the agent's tools and data, apply least privilege, isolate execution (containers, VMs, restricted filesystems), control egress so data can't be exfiltrated, and scope credentials per task. It's the structural defence against prompt injection, agentjacking and the lethal trifecta, since those can't be fully prevented at the prompt level.
Origin
- Coined / introduced by
- Security practice applied to agents
- Story
- Recommended as Adopt in the Thoughtworks Technology Radar, Nov 2026.