Sandbox hygiene: what is inside the box matters as much as the box

Lesson 3 of 5 in Sandboxing and Computer Use: Isolation for What You Cannot Pre-Approve.

Most sandbox failures are not escapes. They are sandboxes that worked exactly as built, around code that had been handed everything it needed.

A perfectly isolated microVM containing a production database URL, a long-lived cloud key, unrestricted internet access, and a mounted home directory is not a sandbox. It is a private workspace for the attacker — quieter than your laptop and less monitored. Four rules turn a box into containment, and each one exists because it kills a specific step in a real attack chain.

1 · No ambient credentials inside the box

The sandbox starts with no secrets in its environment, no cloud role, no mounted credential files, no metadata endpoint, no inherited SSH agent or keychain. If generated code needs to call an API, it does not hold the key — it asks a broker outside the box that holds the credential, checks the request against policy, and returns only the result.

This is least privilege applied to the environment rather than the tool list, and it is the single highest-value rule here. Every exfiltration chain needs data to steal; ambient credentials are how a sandboxed process reaches data nobody meant to give it. Block the link-local metadata address explicitly — it is the most-forgotten credential source in cloud sandboxes, and the one an SSRF or a stray HTTP call finds first.

2 · Controlled egress, default-deny

Egress is where a contained mistake becomes a breach. Default-deny outbound, allowlist by destination, and force traffic through a proxy that logs. Package registries, if needed, go through a pinned internal mirror; DNS resolves only what the allowlist covers, because DNS itself is a channel.

Note how the managed services frame this. AgentCore Code Interpreter exposes configurable network modes — an isolated sandbox, or controlled public network access — as a first-class setting. Foundry documents network egress controls (preview) for hosted agents, configured in the same guardrail policy. In both, egress is a deliberate decision, not a property of the compute. Yours should be too.

And be honest about the limit: an agent that must fetch arbitrary web pages has egress by definition. There, the goal shifts from blocking egress to shrinking what is in the box worth stealing — the trifecta argument, applied to environments.

3 · Ephemeral filesystem, nothing carried forward

Create the workspace at session start, destroy it at session end, and mount only the data this task needs — read-only whenever reading is enough. No shared scratch volume between sessions, no cached artifacts, no “temporary” state that quietly became durable.

Persistence is what lets one poisoned run infect the next: a modified script, a planted dependency, an edited config, a poisoned cache the model will read as fact tomorrow. Ephemerality also makes recovery boring — the response to a suspicious session is to throw the box away, not to clean it.

Where a platform offers persistence for good reasons (AgentCore Instances sessions up to 14 days with re-attaching volumes; Foundry hosted-agent sandboxes with a persistent $HOME and /files for stateful resume), treat it as a deliberate downgrade of this rule and write down what compensates for it.

4 · Resource limits and a wall clock

CPU, memory, process count, disk, file-descriptor and wall-clock caps, all enforced outside the box. This is availability and cost, not confidentiality — and it is the rule teams skip until the first runaway loop.

The OWASP LLM Top 10 calls the failure LLM10:2025 Unbounded Consumption; the agentic threat taxonomy names Resource Overload. Neither needs an attacker: a looping agent that retries a failing build, a fork bomb from generated code, an accidental full-table export. Caps convert an incident into a truncated session and a metric — which is exactly why the reliability plumbing and the security controls are the same knobs viewed from two angles.

Pair every cap with a signal: the sandbox that hit its ceiling should raise an alert, not just die quietly.

5 · The box is observed, and its output is still untrusted

Log what went in and what came out: commands issued, files written, destinations contacted, exit codes, resource peaks. Managed sandboxes give you some of this free — AgentCore logs Code Interpreter actions to AWS CloudTrail, and AgentCore Browser adds Live View, CloudWatch metrics and session recording — but you still have to look, and you still have to keep the traces long enough to investigate.

Then the part everyone forgets: whatever the sandbox returns goes straight back into the model’s context. Output from a contained environment is not sanitized by having been contained. Cap its size, strip or neutralize markup and links, and never let a sandbox result be treated as a more privileged instruction than the user’s own request.

CVE-2024-38206 — a fetch tool with your network position (published 2024-08-06)

Microsoft’s CVE record for Copilot Studio describes an authenticated attacker bypassing SSRF protection to disclose sensitive information over a network — CWE-918, CVSS 3.1 8.5 HIGH. Tenable’s Evan Grant published the mechanism on 2024-08-20: Copilot Studio’s ability to make external web requests, combined with an HTTP 301/302 redirect trick that defeated the SSRF protections, gave researchers access to Microsoft’s internal infrastructure for Copilot Studio — including the Azure Instance Metadata Service (IMDS) and internal Cosmos DB instances — with, in Tenable’s words, “potential cross-tenant impact.” Microsoft mitigated it server-side.

Containment reading. No code interpreter was involved. A single URL-fetching tool inherited the platform’s network position, and the metadata service was reachable from it. The generalisable controls are exactly rules 1 and 2: block the metadata endpoint from every environment that processes model-chosen URLs, default-deny egress and resolve-then-check destinations after redirects, and hold no ambient credential that a request from inside your perimeter can trade for access.

Path allowlists are string comparisons until you make them otherwise

Two path-validation bypasses were published on 2025-07-02 against the official modelcontextprotocol/servers Filesystem reference server: CVE-2025-53110 (a colliding path prefix — a directory whose name merely prefix-matches an allowed one grants access to unintended files, CWE-22) and CVE-2025-53109 (symlinks inside an allowed directory reaching unintended files, CWE-59). Both rated CVSS 7.3 HIGH, fixed in 0.6.4 / 2025.7.01.

If the canonical reference implementation got this wrong, assume your directory allowlist is wrong too. Resolve the real path, refuse symlinks that leave the root, compare path components rather than string prefixes — and put the whole thing inside an ephemeral filesystem so a bypass reaches nothing worth having.

mcp-remote (CVE-2025-6514)

Mechanism. mcp-remote is the widely used shim that lets stdio-only MCP clients talk to remote MCP servers. In versions 0.0.5 through 0.1.15, connecting to an untrusted MCP server let crafted input in the authorization_endpoint response URL during OAuth setup execute OS commands on the client machine. OS command injection, CWE-78, CVSS 3.1 9.6 CRITICAL, published 2025-07-09 with JFrog as CNA; fixed in 0.1.16.

Containment. The client was the victim, and the client was somebody’s laptop with cloud keys on it. Treat every remote MCP server as untrusted input; pin and update client-side tooling like the production dependency it is; and run agent tooling where a client-side RCE reaches a disposable box instead of your credential store.

MCP Inspector (CVE-2025-49596)

Mechanism. MCP Inspector — the official developer tool for testing MCP servers — had no authentication between the Inspector client and its proxy before 0.14.1, so unauthenticated requests could launch MCP commands over stdio. CWE-306, CVSS 9.4 CRITICAL, published 2025-06-13. Reporting credits Oligo Security with showing a drive-by from a malicious web page to a developer’s localhost.

Containment. “It only listens on localhost” is not an authorization decision — any page your browser loads can send requests there. Bind development tooling to authenticated, token-gated endpoints, validate origins, and keep dev-time agent tooling off machines that hold production credentials.

Nx “s1ngularity” (2025-08-26)

Mechanism. Malicious versions of the popular Nx build-system npm packages were published on 2025-08-26 (advisory GHSA-cxm3-wv7p-598c, severity Critical). The postinstall malware scanned filesystems and stole credentials, and — per Wiz’s analysis — leveraged installed AI CLI tools (Claude, Gemini and Q) to aid its reconnaissance, before exfiltrating to attacker-created public repositories named s1ngularity-repository inside victims’ own GitHub accounts. The advisory’s appendix shows the malware prompting the CLI to act as a file-search agent and write an inventory of configuration and environment files to a temp path. A second wave exposed thousands of private repositories.

Containment. The agent was the weapon, not the target — and it worked because the CLI sat on a machine full of credentials with permissive execution settings. Rules 1 and 4 apply to developer workstations too: no long-lived cloud keys sitting in plaintext, dependency installs in a disposable environment, and no standing “approve everything” mode on a machine that can reach production.

Tool: Tool Permission Lab — Tune identity, egress, filesystem and limits on a sandboxed code tool and watch which attack chains survive, in the Permission Lab.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.