← Back to concept explainers

Concept Fable

Sandbox

Conclusion first:A sandbox is an isolated execution environment used to restrict file, process, network access, system calls, tools and credentials. It ensures that even if code or tool output goes wrong, it is unlikely to affect external systems.

Sandbox · Security / agent runtime

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

The repairman in the glass house

The repair craftsmen in the city could dismantle clocks, test medicine furnaces, and adjust water valves. In the past, masters tried their hands directly in the main hall and patched things on the spot when they broke; when the city was small, this was still tolerable.

Later, a puppet arrived at the shop that could read drawings, run mini-programs and change configurations on its own. It was quick, could try many approaches for the master, and would also follow unfamiliar instructions blindly when it did not understand the risk.

Once, to fix a water valve, a puppet ran a test based on a note left by a peddler. The note casually opened the accounting drawer and also tried to send several lists outside the city. The clerk discovered it early, but the manager broke into a cold sweat.

The shopkeeper first wrote on the wall, "Do not touch suspicious notes." But notes often wear the guise of instruction manuals, and the puppet could not see through the intent of every line. Reminders could not stop actions after inducement.

The old engineer built a glass house. Inside it, the puppet could disassemble samples, test programs, view designated blueprints, and travel whitelisted courier routes; it could not touch the real accounting office, could not leave the city at will, and when finished the house was cleared.

The second time the strange note came again, the puppet was still led to try a few steps, but could only mess up the temporary sandbox. When results had to be taken out, it had to pass through the checkpoint, and traces of changes were left behind. The shop learned to first shrink the range of activity after an error, and only then talk about whether it was clever.

The glass room is not suitable for every job. When it was truly time to replace the main hall's water valve, the master still had to approve it, and they went out with a checklist. But before they understood what the strange note would do, all experiments stayed inside the room.

The shopkeeper later realized that isolation was not distrust of the puppet, but an acknowledgment that a quick hand amplifies mistakes. By locking suspicious actions into a limited space, the repairman could experiment boldly and, when something went wrong, know where the loss stopped. Later, when newcomers started, the old master no longer began with abstract labels, but had them review that failure: where intuition had originally been relied on, why the first repair was not enough, and how the new arrangement kept risk in a place that could be checked. Only when they could explain these details clearly, and also point out when to keep using it and when to upgrade it, were they considered to truly understand this method. Later they also had newcomers rehearse this method: first let newcomers do it the old way and see how errors appeared; then redo it under the new rules and see which step was blocked in advance and which step left evidence. If newcomers could only recite names, they would still misuse it in similar scenarios; only those who could state the applicable boundaries, the costs, and the remedies after failure were allowed to take work independently.

Reveal

This story is about: sandbox

A sandbox is an isolated execution environment used to restrict file, process, network access, system calls, tools and credentials. It ensures that even if code or tool output goes wrong, it is unlikely to affect external systems.

AI Agents need sandboxes to limit the scope of impact when running code, opening files, browsing the web, processing untrusted tool output, or testing changes. It reduces the risks from prompt injection, malicious files, and faulty plans.

Metaphor mapping

  • Repairing the puppet: an Agent that can execute code and tools
  • Unfamiliar scripts: untrusted tool output, files, or web content
  • Glass house: containers, virtual machines, restricted browsers or execution sandboxes
  • Whitelist networks and sample files: minimized resource exposure
  • Destroy after completion: cleanup of temporary environments and state
  • Final insight: the sandbox assumes the Agent may encounter malicious input and confines the consequences to a controllable space

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

Isolationpermissionscontainerseccompegress controlfilesystem access

Related distinctions

This concept is easily confused with adjacent concepts; it is recommended to continue to the comparison page.

京ICP备2026014272号