AI glossary
Sandboxing
Sandboxing runs a model's tools or generated code in a confined space, with limited files, network and time, so a mistake or an attack cannot spread.
An agent that can run commands or edit files should do it in a container, a separate folder or a throwaway machine, not on the host with your keys and data.
A good sandbox limits several things at once: which paths can be read and written, which hosts can be reached, how long a command may run and how much memory it may use.
Check paths after resolving them. "../" and symbolic links are the classic ways out of a folder a tool thought it was confined to.
Learn it hands-on
These free lessons teach it with commands to run in a lab and checked tasks. Read them whole with no account.