sandbox

GitHub Next introduces enclaves, an experimental security primitive for GitHub Agentic Workflows that lets agents work across repositories while deterministically constraining what they can communicate back, mitigating private-to-public data leaks like the GitLost attack.

DeerFlow is given a secure Docker-based "computer" sandbox that can execute commands, manage files, and run long tasks, bundling Browser, Shell, File, MCP and VSCode Server in a single container with uploads, workspace, and outputs folders.

Phil Schmid explains how AI agents are collapsing their tool catalogs into a single `exec` tool — Code Mode — where models write TypeScript/Python scripts in a sandbox to chain actions, and argues MCP will return strong in 2027, with a minimal example for Gemini 4 Argon.

The author released Cyber-Butler-Security (CBS), an open-source Windows-native OS-level sandbox for local LLM agents that treats tool calls like syscalls, uses dual-account ACL isolation and a TOTP broker for high-risk actions, and fails closed by default.

Matt Pocock is working on Sandcastle v1, a 'software factory' tool that integrates AI coding harnesses like Claude Code and Codex with sandbox providers, HITL support, and his skills repo converted into callable Agent() functions.

HarborRL has open-sourced a lightweight agent reinforcement learning framework that integrates model serving, trajectory generation, tool execution, verifier-based rewards, and policy updates into a reproducible pipeline. It supports flexible combinations of Qwen/GLM models × GRPO/DAPO algorithms × 200+ sandbox tasks × 40+ agent harnesses (such as Claude Code and SWE-agent).

This article breaks down the dozen-plus key components Anthropic built in-house for its AI agent, and identifies its outsourcing principle: components that age alongside model updates are built in-house; sandboxes that merely provide compute can be outsourced.

Paddock launches on Product Hunt, giving each AI agent its own Linux computer or locked-down sandbox on a single self-owned VPS. It is free, open source, and MIT licensed.

Simon Willison publishes a research report evaluating webframe, Jeff Lindsay's lightweight Go tool for running web pages like programs in a headless system web view, finding it fast and comparable to shot-scraper but with rough edges like CSP failures and missing HTTP metadata.

Microsoft has open sourced NVX, an ultra-lightweight cross-platform MicroVM sandbox built on OpenVMM, designed to run untrusted workloads with hardware-enforced isolation. It supports Windows (WHP) and Linux (KVM/MSHV), and is believed to be the underlying implementation of Azure Sandbox.

The author discusses the shortcomings of open-source Sandbox services and proposes two core requirements: rootfs should use cloud storage to improve availability during node failures and reduce pause latency, and the /workspace file interface should be usable even when the sandbox is not started. They also emphasize building on the Kubernetes ecosystem rather than maintaining a separate cluster.

一条关于 E2B 创始人 Vasek 发表"Sandboxes are dead"文章的分析线程，剖析了这家 AI 沙箱市场领导者为何要主动淘汰自己的品类，转向"agent 驱动的私有云"以应对开源自我蚕食、计费模式劣势和竞品夹击。

Perplexity 开源了其 Computer 背后的沙箱平台 SPACE（Apache 2.0），为每个 Agent 任务提供独立的 Firecracker microVM，并在 VM 外部管控凭证与出站网络流量，还包含 E2B 兼容层，这对构建 Agent harness 的开发者意义重大。

Perplexity 开源了其沙箱平台 SPACE（Sandboxed Platform for Agentic Code Execution），该平台基于 Firecracker 微虚拟机，为 Perplexity Computer 上运行的所有智能体提供隔离的代码执行环境，支持通过 HTTP API 管理沙箱生命周期。

Sandbox company E2B says its usage has doubled to 2 billion sandboxes in 5 months, with 61% of traffic already coming from AI agents. Despite the underlying infrastructure becoming increasingly commoditized, the 16-person team is betting on open source and a secure private cloud strategy.

Mudroom 是一款开源工具，可在 Linux 沙盒虚拟机中运行 Claude Code、Codex、Gemini CLI 等编码代理，并以 PR 方式审查与回滚代码变更。提供 Mac 应用及 Linux/Windows CLI，免费且采用 MIT 许可。

Plimsoll 是一个自托管沙箱工具，用于运行 AI 代理编写的不可信代码，并在每次结果中明确标注隔离强度（process/container/kernel/vm），支持最低隔离层级要求、运行记录哈希校验与签名验证。

开发者介绍 FetchSandbox——一个用于安全测试 AI agent 构建的工作流的沙箱环境，无需连接真实账户即可验证状态、回放 webhook 并捕获重复扣费/重复邮件等问题。

Microsoft's ThinkingBox, a sandbox for evaluating AI agents on stateful business workflows by grading terminal database state rather than agent messages, is now available as a Hugging Face OpenEnv environment alongside the 507-task ThinkingBox-Bench benchmark.

CanadaHonk proposes a JavaScript-focused sandbox product that accepts untrusted code in and returns output out, targeting agent/user code execution with isolation better than Cloudflare Workers at roughly 100x lower cost than dynamic workers.