Sandboxing an AI Agent

What you’ll learn and how you can apply it

• Understand the sandbox end to end: Learn how the threat model, the isolation spectrum, fast starts, data flow in and out, and the seams fit together as one layer, and why the workload being untrusted shapes each design decision
• Read and reason about isolation tiers: Go from process-level restriction to containers to userspace kernels to microVMs, knowing what each newly blocks, its escape surface, and its rough cost, so you can tell which boundary a given workload needs
• Operate and choose sandbox infrastructure: Handle cold starts, snapshots, data flow, egress, secrets, audit, lifetimes, and cost, then compare representative managed providers against self-hosting the open-source stack

Course description

Your agent can run code, read files, fetch URLs, install dependencies, and use credentials. That makes the execution layer around the agent part of your security boundary. Sometimes the model writes the code; sometimes a poisoned repository, malicious package, or prompt injection influences what runs. Containment is the industry’s answer because a strong boundary is what makes autonomous agent modes safe to offer. Sajal Sharma opens up that boundary, shows how each isolation tier works, and teaches you to build, operate, and choose one.

You’ll start with the threat model and real incidents, each mapped to the isolation property that would have contained it. Then you’ll walk the isolation spectrum as four tiers: process-level restriction, the container and when Docker is enough, the userspace kernel, and the microVM. You’ll understand what each tier blocks, what it still exposes, what it costs, and how to decide which boundary a workload needs. Then you’ll learn how to make your sandbox production-ready: fast starts with templates, snapshots, and warm pools; code in and results out without importing credentials; and the seams where boundaries leak, including egress, secrets, identity, and audit. You’ll use two patterns to implement sandboxes: one as a tool backend and one that hosts the whole agent.