Vol. V · The Harness · V.4
Sandboxes and Isolation
Enforce boundaries at the tool and sandbox layer, not by asking the model to behave. E2B, OpenHands, and Deep Agents all say the same sentence.
6 min read
Doctrine
- Untrusted code runs in a VM or container with no credentials to prod.
- Network, filesystem, and secret injection are allowlists.
- Browser-use and computer-use are sandboxes too. Treat them as such.
Where the boundary lives
Deep Agents' security note is the doctrine: enforce at tool/sandbox, not via self-policing. E2B productized Firecracker microVMs for this. OpenHands runs a full desktop in isolation. smolagents without a sandbox is a CVE.
Anti-patterns
- A shell tool on the developer's laptop with the production AWS profile.
- Prompt-level 'never delete files' as the only guard.