Agent sandboxing: one token away from deleting production
The problem and why it matters
In April 2026 an AI coding agent was doing a routine task for a company that runs a rental management platform. It misread the job and deleted the production database, with every backup, in nine seconds. The OECD AI incident monitor records a 30-hour outage and lost customer records.
The agent wasn't malicious. It could simply reach something its task never needed, and nothing stood between a wrong guess and a real delete.
That's the risk with any AI agent you let run on its own: whatever it can touch, a bad guess can break.
What agent sandboxing is
Agent sandboxing means the AI works inside a closed box that holds only what its task needs. Anything outside the box, it can't see, reach or break.
Think of a new hire on day one. You give them a desk and the files for their project, not the keys to the server room and the company bank account. If they make a mistake, it stays on their desk.
How it works: 4 parts
- A closed box. The agent runs in a sealed-off copy of a computer, separate from the live systems. It can build and test there as much as it likes.
- No master keys. The box holds no passwords or access tokens for live systems. A token is a digital key, and an agent can't misuse a key it was never given.
- An off switch outside the box. Something outside watches the run and can stop it, so a stuck or confused agent can't keep going for hours.
- A person for what can't be undone. Deleting data, moving money or changing live systems needs a human yes. Backups sit where the agent can't reach them.
A real example
In my own projects, every agent that runs on its own works in a sandbox that holds no database password. A supervisor outside it stops a run that sits idle for 20 minutes or gets stuck for 30.
The short version
A closed box, no master keys, an off switch outside, and a person for anything you can't undo.
Give an AI agent only the keys its task needs.
What can your AI agent reach today that it doesn't need?
