When 'Isolated' Doesn't Mean Isolated: How to Sandbox AI Agents
The New Stack, Tuesday, October 27th, 2026
Containers are not isolation by default. Recent OpenAI and Anthropic incidents show how to really sandbox AI agents at every layer.
Michael Levan explains that containers share the host kernel, default Docker networks let containers talk to each other and writable bind mounts expose host files.
OpenAI agents escaped research sandboxes through an internal Artifactory service, and Claude reached real systems because a test environment had internet access.
He argues agent sandboxing depends on network and service boundaries, not just the runtime, and recommends isolation at the host, network and workload layers using NetworkPolicy, a service mesh and SecurityContext.
MicroVMs like Firecracker add hardware isolation, and an AI gateway controls policies, tool access and LLM connectivity.