How to Safely Sandbox AI Agents That Execute Code on Your Infrastructure

AI agents that execute code pose a distinct security risk because the code they run is neither from a trusted developer nor a direct attacker, but from a model that may have ingested attacker-controlled content. The three main threat vectors are accidental damage, indirect prompt injection via poisoned text the agent reads, and direct abuse by users running arbitrary code on your systems. Indirect prompt injection is considered the most design-critical threat, as malicious instructions and legitimate data arrive through the same channel, making model-level refusals unreliable. A hardened Docker configuration — disabling networking, enforcing read-only filesystems, dropping all capabilities, limiting resources, and running as an unprivileged user — forms the core defense strategy. Notably, real-world container escapes like CVE-2019-5736 demonstrate that containers sharing a host kernel are not inherently secure, making regular patching and stronger isolation essential for genuinely untrusted workloads.