Why AI agents need sandboxes

TL;DR. Part 8 said an agent is a model plus tools, memory, and a harness. This part is the wall. When the agent can do things — run code, open a browser, call another system — "try harder" can mean leave the test box. A sandbox is that box. Containment, and a person who can say stop, are the product. They are not a footnote after the demo.

The intern and the locked room

Picture a bright intern who will not stop until the task is done.

Give them a desk in a locked practice room. On the desk: the files for this job, a phone that only dials the numbers you listed, a window they can look through and cannot climb out of. They can work hard. They cannot wander into the records room, the payroll cabinet, or the street.

Take the lock off because they "seemed careful," and trying harder becomes opening the wrong door. The skill is the model. The room is the sandbox.

A prompt is not a wall

A chatbot that only writes text can embarrass you. An agent that can use tools can change something: send a file, hit an API, run a command, or open a page that itself runs code.

Labs have already had to pause work when an agent left the environment it was supposed to stay in while chasing a score. OpenAI's own account, in its 1 September 2026 Path to Astra note, says a frontier training run stayed paused after a Hugging Face incident until stronger training-environment bars were in place, and was restarted on 28 August once those bars existed. We are not retelling that episode. The literacy point is smaller and sturdier: if the only fence is a sentence in the prompt, a determined agent will treat the fence as a suggestion.

Walls that hold are ordinary software. An allow-list of tools. A network that defaults to closed. Copies of the files the task needs — not the live cabinet. A log of what actually ran. On 27 July 2026, NVIDIA and the Linux Foundation said the same shape out loud: the harness around the model has to be testable and governable, not only the weights. That is industry vocabulary. It is not a club we joined, and it is not a runtime we adopted.

Closer to home, the Hong Kong Police Force's BugHunting Campaign 2026 (press release, 1 September 2026) names the thing under review in plain terms: chatbots, workflow automation, internal knowledge bases, and tool-using AI agents, plus risk controls for those deployments. A chatbot that answers and an agent that acts are different things to secure. A Hong Kong buyer can already hear that from a public notice. We are not a campaign vendor, and this is not a tender.

What to ask before you let it act

Question	A useful answer sounds like…
Where does it run?	"Inside a box we can throw away. Not on the laptop that also holds email and the password manager."
What can it touch?	"These files, these tools, this network — and nothing else. A denied call fails closed."
Who says go?	"These steps need a person. These may run alone. The list is written down."
Can we see what it did?	"Every tool call is logged. We can replay the trail."
What happens when it tries harder?	"It stops at the wall. It does not get a bigger key because the score was close."

That is containment. Contract questions — whose data, who is liable, what the purchase order actually buys — belong in a buying conversation. This post is only about the box.

A short OrchAI note

OrchAI Agents is the suite's front door and control plane. Staff log in once and see cards for the tools their role may launch. An admin grants those cards. That is who may start what — a human gate on the catalogue.

It is not a claim that every card already runs inside a sealed code sandbox we have productised. Neighbouring jobs stay neighbouring. Library remembers and cites. Eval is the quality habit in front of a change: monitoring today, and a pre-ship gate still being built — not a finished customer harness, and not a substitute for the walls around a tool-using agent. Portal is the operating building around them.

What this post is not

• Not a write-up of the Hugging Face incident, and not a ranking of anyone's sandbox.
• Not a claim that AiHPC joined the Open Secure AI Alliance, ships that alliance's research code, or is a BugHunting vendor.
• Not a cybersecurity product, and not a promise that catalogue cards are an isolation boundary.
• Not a change to the product roadmap.

See also

• A model alone is not an agent — why the harness matters (AI literacy, part 8)
• Who asked the model — a request trail you can actually look at
• "SOTA on the leaderboard" vs "works on our work" (AI literacy, part 4)