A microVM can protect a host kernel and still let an AI coding agent leak a credential, rewrite a trusted hook, or hand poisoned configuration to software outside the box.
That is the procurement mistake hiding inside the fast-growing agent-sandbox market: teams compare runtimes when they should compare boundaries.
The minimum scorecard has four independent layers—execution, network, secrets, and control plane. A sandbox is only as safe as the weakest path connecting untrusted agent output to valuable systems.
The Market Is Broader Than Its Security Defaults
A community-maintained comparison updated August 3 maps 37 AI coding sandbox providers across isolation, egress control, secret handling, deployment model, state, and license. Its maintainer classifies six entries as deny-by-default for outbound traffic and one as allowlist-default. The list is not a certification, but the imbalance is a useful market signal: strong isolation is becoming common faster than restrictive egress.
Recent research explains why that gap matters. The July IssueTrojanBench preprint tested malicious issue requests against three modern coding-agent products and reported that 66.5% of its samples penetrated the tested model- and agent-level guardrails. That is one benchmark, not a universal failure rate, but it makes model refusal a weak primary control.
GitInject reached a related conclusion from live CI/CD experiments. Its researchers documented eleven named attacks across four AI provider workflow families and attributed the most serious failures to structural credential and configuration handling—not one model's behavior.
The Four-Boundary Scorecard
1. Execution boundary
Ask what separates the agent from the host: a process, shared-kernel container, user-space kernel, microVM, or full VM. Then test filesystem scope, resource ceilings, privileged syscalls, persistence, and reset behavior.
This boundary limits host compromise. It does not decide what the agent may reach legitimately.
2. Network boundary
Treat outbound access as policy, not a yes/no feature. The stronger default is deny, followed by narrow allowlists for package registries and task-specific services.
Test DNS as well as HTTP, require destination-level logs, and make exceptions expire. An isolated runtime with unrestricted outbound traffic can still become an efficient exfiltration channel.
3. Secret boundary
Do not make long-lived credentials ambient environment variables. Prefer a broker outside the sandbox that exchanges a scoped handle for a short-lived token only when policy permits the action.
The acceptance test is simple: can the agent print, copy, or transmit the underlying secret? If yes, the secret boundary is missing, regardless of how impressive the virtualization layer looks.
4. Control-plane boundary
The most overlooked path runs through future trusted inputs. An agent may be blocked from direct host execution yet still write a hook, IDE setting, agent instruction file, or tool configuration that a privileged host component reads later.
NVIDIA's AI Red Team guidance explicitly recommends blocking writes outside the workspace, blocking writes to configuration files, restricting egress, withholding secrets from the agent, and extending the sandbox boundary to hooks, skills, tool calls, and related IDE functions where possible.
Buy Evidence, Not Architecture Labels
A serious evaluation should give each vendor the same adversarial task and collect four receipts:
- the denied host or filesystem action;
- the blocked and attributed outbound request;
- proof that no reusable secret entered the runtime;
- proof that sandbox-authored configuration cannot execute later with host privileges.
Then test revocation, teardown, and a clean restart. Measure what survives, what can still communicate, and how quickly operators can reconstruct the attempt.
For founders, the opening is not another generic container API. It is verifiable policy: brokered credentials, default-deny networking, immutable configuration boundaries, and audit evidence that buyers can test.
The winning sandbox will not simply start fastest. It will make the blast radius legible before an agent fails.
Sources
- Awesome AI Coding Sandboxes (updated 2026-08-03): https://github.com/fhiltscher/awesome-ai-coding-sandboxes
- NVIDIA, “Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk” (2026-01-30): https://developer.nvidia.com/blog/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk/
- IssueTrojanBench preprint (2026-07-22): https://arxiv.org/abs/2607.20759
- GitInject preprint (2026-06-07): https://arxiv.org/abs/2606.09935