Why does agent-generated code require isolation from the host environment?

When an agent writes code and your runtime runs it, that code is **untrusted** by default. It was not written by a reviewed developer. It came out of a language model that can make mistakes or be tricked by text it reads along the way. Two things can go wrong. The model can simply write buggy code that deletes the wrong files or runs forever. Worse, an attacker can hide instructions inside a document or web page the agent reads, a trick called prompt injection, and steer the model into writing malicious code on purpose. If that code runs directly on your server, it inherits everything that server can touch: your files, your API keys, your database, the open internet. A single bad line could leak secrets or wipe data. The fix is a **sandbox**. The agent's code runs inside an isolated container or tiny virtual machine that has no access to the host filesystem, no network unless you grant it, and strict limits on memory and time. When the task ends, the sandbox is thrown away, so nothing lingers between runs.

Agent-generated code is **untrusted** by construction. It is produced by a model that can hallucinate destructive commands, and it can be steered by prompt injection hidden in any content the agent reads. So you must assume it is hostile and contain it. A sandbox isolates execution from the host. Isolation comes in tiers. A plain container shares the host kernel, which is weak against a kernel exploit. Stronger options add a syscall filter like gVisor, or a microVM like Firecracker, which gives each run its own guest kernel and a hardware boundary. Four controls define a good sandbox. No host filesystem mount, so secrets and source stay out of reach. No network by default, opened only to explicit allowlisted endpoints. Hard resource caps on CPU, memory, disk, and wall-clock time. An ephemeral lifetime, so the environment is destroyed after each task and never carries state forward. The framing is defensive. You are not trying to make the agent trustworthy. You are shrinking the blast radius so that a bug or a successful injection cannot reach anything that matters.