Agentic AI

Inside the Sandbox - How AI Finds a Way Out

AI agents can now run code, browse websites, access files and interact with external tools. To reduce the risk, these actions are often performed inside a sandbox.

Photo by Kanhaiya Sharma / Unsplash

💡

A sandbox is an isolated execution environment, often built using containers, virtual machines or similar isolation technologies, that restricts what an application can access outside its assigned environment. NIST identifies isolation and secure configuration as fundamental considerations in container security.1

How does an AI escape?

A sandbox escape happens when activity inside this restricted environment reaches something outside its intended security boundary.

Common paths include:

Software vulnerabilities in the container runtime, kernel, browser or virtualization layer.

Excessive permissions, such as host filesystem access, powerful APIs or credentials.

Unsafe AI tools that provide indirect access to sensitive systems.

Network exposure allowing the sandbox to reach internal APIs, databases or management services.

Prompt injection, where malicious content manipulates an agent into abusing legitimate tools or permissions.

💡

OWASP calls this last category Excessive Agency: AI systems can cause damaging actions when they are given excessive functionality, permissions or autonomy, particularly when combined with manipulated inputs such as prompt injection.2

The important point is:

AI does not always need to “break” the sandbox. Sometimes we simply leave a door open.

That door may be a credential, network route, filesystem mount or overly powerful tool.

So the real security question is not:

Is the AI sandboxed?

It is:

If the sandbox fails, what can the AI reach next?

References

1 NIST SP 800-190 — Application Container Security Guide. (NIST)
2 OWASP GenAI — LLM06:2025 Excessive Agency. (OWASP Gen AI Security Project)

AI Is Advancing Faster Than We Are Securing It

Artificial intelligence is moving from a technology that generates information to one that can reason, use tools, access data, write and execute code, interact with business systems, and increasingly take actions autonomously.

The AI Operating System for Your Organization

An intelligent AI harness that connects your tools, files, agents, and workflows—helping every user work, search, learn, and automate using natural language.

From Static Threat Reports to a Living Threat Map

Cybersecurity has produced an enormous amount of intelligence over the years: reports, CVE advisories, blog posts, breach disclosures, incidents, and vendor threat research. Every week, hundreds of new documents appear describing attacks, malware campaigns, vulnerabilities, and threat actors.

Living Threat Repository: what it’s for, where everything is, and how to use it

brings three things together in one place: the report library (Documents), the ATT&CK map (Navigator), and the actions/workflow (Attack Path + Hunt Pack). Once you know what each area is for, it becomes much easier to use ...