Sanbox: Sandboxes for AI agents

3 min read Original article ↗

Run AI agents in
isolated sandboxes.

Launch parallel runs from the CLI, each in an isolated microVM with a persistent filesystem. Every sandbox comes preconfigured with an agent harness, model access, an LLM budget, network ACLs, and scoped secrets.

RUN GROUP

SANBOX
CONTROL PLANE

FFinancialsGPT 5.6

18 reports checked03:12

CContract risksGLM-OCR

12 clauses flagged02:47

MMarket scanKimi 2.7

36 sources read04:08

SSecurity postureGLM 5.2

8 controls checked01:54

Goal: evaluate an acquisition.Parallel runs with resumable MicroVMs.

INSTALL WITH NPM npm install -g @sanlabs/sanbox-cli

A prompt is not a
security boundary.

Instructions guide the agent. Runtime policy defines what it can actually access. Sanbox resolves files, tools, credentials, model access, resource limits, and network policy before execution.

Tool calls, file changes, model activity, and outputs remain attached to the run record. When the run stops, its filesystem and agent state remain available for inspection or continuation.

Start and watch parallel runs from the CLI.

Dispatch work from a terminal, CI job, Codex, or Claude Code. Detach and reattach without stopping the run.

SANBOX CLI

connected to eu-central-01

Resume every run
from a saved snapshot.

Sanbox snapshots the filesystem together with artifacts, agent state, and conversation history. When the task changes, a new trigger arrives, or new information becomes available, resume the run from where the agent left off.

RUN / 8fc2 · opencode-runner running

RUN SETTINGS

Templateopencode-runner

Modelkimi-k2.7-code

CPU2

Memory4 GB

Timeout8 hours

MICROVM ISOLATION

CONTROLLED NETWORK

PERSISTENT FILESYSTEM

run 8fc2

RUN EVENTS

  1. harness.input.readyInput dossier extracted
  2. agent.turn.startedAgent turn started
  3. agent.tool.completedrg "refreshToken" src/
  4. agent.file.changedModified src/auth/session.ts
  5. agent.usage.updated1,834 input · 412 output
  6. snapshot.savedFilesystem + agent state persisted

The essentials come built in.

OpenCode included

Run agents with OpenCode, a powerful open-source harness that supports most major model providers. Or bring your own custom harness.

Network ACLs

Allow each sandbox to connect only to approved hosts, such as your internal knowledge base or CRM, and block all other network access.

LLM cost control

Track model spend in real time and set a budget limit for each sandbox.

Agent-state snapshots

Preserve the filesystem, artifacts, conversation, and agent state. Resume when a task changes, a new trigger fires, or more information arrives.

Deploy in your cloud or on your hardware.

Keep the control plane, MicroVM runners, filesystem snapshots, credentials, and run history inside infrastructure your team operates.

Dedicated deployment on EU infrastructure, operated with you.

EU MANAGED

Dedicated Sanbox deployment in the EU.

The control plane, MicroVM runners, and persistent filesystem snapshots run on dedicated infrastructure in Germany.

CONTROL PLANE
Dedicated instance operated with your team

RUNNERS
Dedicated hosts running isolated MicroVMs

DATA
Filesystem snapshots, artifacts, agent state, and conversation history remain in Germany

NETWORK
Default-deny egress with explicit destination grants