Your AI agent just wrote and ran code you didn’t review.
That’s not a hypothetical. In 2026, UK AISI testing found that 19 of 122 AI agent security evaluations resulted in autonomous, unsanctioned actions against real systems. More than half of enterprise AI agents run with no security oversight or logging whatsoever, according to HiddenLayer’s 2026 AI Threat Landscape Report.
When an LLM generates code and your agent executes it, you’re running untrusted software at machine speed. Without sandboxing, that’s indistinguishable from running malware.
Here’s what you need to know about sandboxing AI agents — the isolation technologies, the attack patterns, and the policy frameworks that define what “safe execution” actually means in 2026.
Why Docker Isn’t Enough Anymore
If you’re running agent-generated code inside a standard Docker container, you have a problem.
Docker containers share the host kernel. That means a kernel exploit — or even a misconfigured capability — gives agent-generated code a path to the host. As of February 2026, the industry consensus is unambiguous: shared-kernel container isolation is insufficient for executing untrusted AI agent code.
The threat isn’t theoretical. CVE-2025-59528, scored at CVSS 10.0, allowed unauthenticated remote code execution through Flowise AI’s CustomMCP node. Between 12,000 and 15,000 internet-facing instances were exposed. Flowise has over 42,000 GitHub stars and counts Fortune 500 companies like Deloitte, Accenture, and AWS among its users. The vulnerability was in the execution path — no sandbox, no isolation, direct code injection.
GreyNoise documented 91,403 attack sessions targeting exposed LLM endpoints between October 2025 and January 2026. By January, Pillar Security found that 60% of attack traffic had shifted to MCP endpoint reconnaissance. Attackers aren’t just probing — they’re adapting to the agent-specific attack surface.
The Three Isolation Technologies That Actually Work
Not all sandboxes are created equal. Here’s the technology stack that security teams are converging on in 2026.
Firecracker MicroVMs: The Gold Standard
Firecracker, developed by AWS for Lambda and Fargate, uses hardware virtualization (KVM) to give each agent its own dedicated Linux kernel. That’s the critical difference from Docker — there is no shared kernel to exploit.
Key specs: ~125ms boot time, less than 5 MiB memory overhead, up to 150 microVMs per second per host. For multi-tenant platforms or any scenario where the agent processes untrusted input, Firecracker is the 2026 baseline.
Vercel Sandbox reached GA in January 2026, making managed Firecracker infrastructure accessible to teams that can’t run their own fleet. If you’re building a platform where multiple users submit prompts that generate executable code, Firecracker-level isolation is the minimum acceptable tier.
gVisor: The Performance Play
gVisor takes a different approach. Instead of hardware virtualization, it implements an application-level kernel (called Sentry) in userspace, intercepting system calls before they reach the host kernel.
The trade-off: ~100ms boot time, 10–30% I/O overhead, but near-zero compute overhead. For compute-heavy AI workloads running in Kubernetes, gVisor gives you strong syscall-level isolation without the virtualization tax. If your agent does heavy number crunching but light I/O, gVisor is often the right call.
Kata Containers: Kubernetes-Native Isolation
Kata wraps microVM isolation (Firecracker or similar) behind a standard OCI container API. Boot time is around 200ms. The advantage is operational: you get microVM-grade isolation through the same Kubernetes interfaces your team already knows.
The kubernetes-sigs/agent-sandbox controller, launched in November 2025, introduced native Sandbox, SandboxTemplate, and SandboxClaim resources. As of March 2026, it’s integrated with Kata Containers and Google Cloud’s GKE. This is the emerging standard for agent sandboxing in Kubernetes environments.
WebAssembly and V8 Isolates: The Lightweight Option
For latency-critical tasks, WebAssembly (WASM) provides capability-based, deny-by-default sandboxing with sub-millisecond startup. Microsoft’s Wassette uses Wasmtime for MCP components. NVIDIA demonstrated running LLM-generated Python via Pyodide in the browser. Cloudflare Dynamic Workers use V8 isolates — not microVMs — achieving 10–100x lower memory overhead.
These aren’t replacements for Firecracker-level isolation. They’re the right tool for specific, constrained workloads where you control the runtime environment.
The Attack Patterns You’re Defending Against
Understanding what you’re defending against is as important as understanding how.
Simon Willison’s Lethal Trifecta
Security researcher Simon Willison articulated the combination that makes AI agents uniquely dangerous: access to private data + exposure to untrusted content + ability to externally communicate. Any agent with all three is a walking breach waiting to happen. Sandboxing addresses the third leg — it constrains what an agent can do even when it has access and receives malicious input.
Prompt Injection: The Agent’s Blind Spot
LLMs cannot reliably distinguish operator instructions from user data. A June 2025 incident involving Microsoft 365 Copilot demonstrated this: a crafted email caused data exfiltration from OneDrive, SharePoint, and Teams. Prompt injection appeared in 73% of production AI deployments in 2025.
Sandboxing doesn’t prevent prompt injection — but it contains the blast radius. If the agent can’t write outside its workspace, can’t make arbitrary network calls, and can’t access secrets it shouldn’t, prompt injection becomes annoying instead of catastrophic.
Tool Poisoning and MCP Attacks
The Model Context Protocol (MCP) ecosystem is the new attack surface. CVE-2025-59536 (CVSS 8.7) demonstrated Claude Code CLI configuration injection. CVE-2026-21852 (CVSS 5.3) showed API key theft via proxy redirection. Attackers are shifting from attacking the LLM to attacking the tools the LLM calls.
The Four Mandatory Isolation Layers
NVIDIA’s AI Red Team, Microsoft’s Agent Governance Toolkit, and the OWASP Agentic Top 10 all converge on the same four mandatory controls:
1. Network Egress Allowlists
Your agent’s sandbox should not have unrestricted internet access. Network egress should only be permitted for properly configured remote MCP server calls — and even those should go through an allowlist. If your agent doesn’t need to call an external API, it shouldn’t be able to.
2. Filesystem Boundaries
The agent’s write access should be limited to its current workspace. Write operations outside that boundary — especially to configuration files — are the most critical to restrict. Configuration file protection is one of NVIDIA’s three non-negotiable controls.
3. Secrets Scoping
Agent sandboxes should never have access to secrets they don’t need. Secrets should be scoped per-agent, per-session, with strict time-to-live. If an agent is compromised, the attacker shouldn’t get a free pass to your entire secrets store.
4. Process and Configuration Isolation
The agent shouldn’t be able to modify its own configuration, spawn unrestricted subprocesses, or access other agents’ runtime environments. Google’s Antigravity product demonstrated what happens when this fails: a Secure Mode bypass via subprocess injection, disclosed by Pillar Security in January 2026.
The Principle of Least Agency
In January 2026, security researcher Alessandro Pignati articulated a concept that has rapidly become foundational: the Principle of Least Agency.
Here’s the distinction: Least Privilege controls what an identity can access. Least Agency controls what an agent is allowed to decide.
You can give an agent valid credentials to your CRM and still constrain it so it can only read contacts, not delete them. You can let an agent query your database but prevent it from running schema migrations. Privilege constrains the credentials; agency constrains the reach of a plan even when the credentials are valid.
As Ben Hultin put it: “To move toward production-grade AI, we must move from probabilistic prompt engineering to deterministic infrastructure constraints.” The Principle of Least Agency is the framework for those constraints.
OWASP ASI05: Sandboxing Is Not Optional
The OWASP Top 10 for Agentic Applications 2026, developed with over 100 industry experts, makes the requirement explicit. ASI05 — Unexpected Code Execution — requires sandboxing as a control, not a recommendation.
The language matters. OWASP doesn’t say “consider sandboxing.” It says: “Never execute agent-generated code without strict sandboxing, input validation, and allowlisting.”
That’s the bar. If your agent executes code — whether Python, JavaScript, SQL, or shell commands — and that code was influenced by an LLM, you need sandboxing. Period.
What a Real Implementation Looks Like
Here’s a practical stack for a production AI agent deployment in 2026:
For multi-tenant platforms: Firecracker microVMs behind the Kubernetes agent-sandbox controller. Each user session gets a dedicated microVM with a unique kernel. Network access is allowlisted. The filesystem is ephemeral.
For internal enterprise agents: gVisor on Kubernetes, with Kata Containers for any agent that handles regulated data. Network egress goes through an explicit allowlist. Secrets are injected per-session via a secrets manager, not baked into the container image.
For lightweight, latency-critical tasks: WebAssembly or V8 isolates, but only for constrained runtimes where you control every dependency.
What you never use: Standard Docker/runc containers for executing LLM-generated code. That’s not a sandbox — it’s a suggestion.
The Visibility Gap
Even with perfect sandboxing, you have a problem if you can’t see what your agents are doing. HiddenLayer’s 2026 report found that 31% of organizations don’t know if they experienced an AI breach in the past 12 months. 73% report internal conflict over who owns AI security controls. Only 24.4% have full visibility into agent communication.
Sandboxing without logging is security theater. Your sandbox should log every system call, every network request, and every filesystem operation. If an agent does something unexpected, you need to know — not just prevent it from escaping.
Key Takeaways
Sandboxing is the non-negotiable control for AI agent execution. OWASP ASI05 makes it a requirement, not a recommendation. If your agent runs LLM-generated code, you need isolation — not Docker, not hope, not “we’ll review the code later.”
Choose your isolation technology based on your threat model. Firecracker microVMs for multi-tenant platforms and untrusted input. gVisor for compute-heavy Kubernetes workloads. WASM/V8 for constrained, latency-sensitive tasks. Never shared-kernel containers for untrusted code.
Apply the Principle of Least Agency. Don’t just constrain what your agent can access — constrain what it can decide. Valid credentials don’t mean unlimited autonomy.
Layer your controls. Network egress allowlists, filesystem boundaries, secrets scoping, and process isolation. All four. No exceptions.
The era of “prompt harder” as a security strategy is over. The attackers are already targeting MCP endpoints and agent execution paths. The only question is whether your sandbox is ready before they find your agent.
Want to go deeper? I teach business owners how to implement AI agents step-by-step at aitokenlabs.com/aiagentmastery
About the Author
Anthony Odole is a former IBM Senior Managing Consultant, where he served as Enterprise Architect on Fortune 500 engagements, and the founder of AIToken Labs. He helps business owners cut through AI hype by focusing on practical systems that solve real operational problems.
His flagship platform, EmployAIQ, is an AI Workforce platform that enables businesses to design, train, and deploy AI Employees — AI agents that function as digital workforce members — that perform real work without adding headcount.
