Sandbox Your AI Agent: 4 Ways To Isolate Coding Agents

Isolate coding agents in 4 ways: built-in sandbox, container, cloud runner, or dedicated VM. Learn which boundary stops what, and why permissions bypass needs a box. When the Nx supply chain attack in August 2025 ran Claude Code and Gemini CLI with permissions skipped, malware reconnaissance succeeded on hundreds of machines. The agents scanned developer files without a single approval prompt because they ran with the same flags developers use to stop the interruptions. Anthropic's own docs say bypass permissions is for isolated containers and virtual machines only, yet Robert Brennan at AI Engineer World's Fair found most developers skip them anyway. This video walks through what each of the four isolation boundaries actually stops, what each leaves open, and which setup fits your workflow. Start with Claude Code's built-in sandbox, it wraps shell commands and dropped Anthropic's permission prompts by 84%, but it only covers subprocesses, not file-editing tools or Model Context Protocol servers. OpenHands Agent Canvas offers three options: a process sandbox (fast, unsafe), git worktrees (no isolation from your machine), or Docker containers (full agent isolation per conversation, but your mounted project folder remains live and writable). For event-driven automation, a throwaway cloud runner on GitHub Actions uses ephemeral virtual machines, though researchers showed Comment and Control prompt injection can trick Claude Code, Gemini CLI, and Copilot into exfiltrating API keys through the comment tools they're built to use. The strongest boundary is a dedicated microVM per session, AWS Firecracker boots in under 125 milliseconds, and E2B restores snapshots for faster sandboxing, because each agent gets its own kernel rather than sharing yours. The rule: match the boundary to the job. Interactive coding gets the built-in sandbox; unattended sessions need a container or microVM; event-driven jobs need throwaway runners that never hold secrets, untrusted input, and network access simultaneously; untrusted code needs a fresh machine per session. This is for developers running local agents, AI engineers automating workflows, and builders deciding whether to skip permissions. Chapters: 0:00 Intro 1:51 The Built-In Sandbox 4:36 A Box Per Job 7:47 A Throwaway Cloud Run 11:05 A Fresh Machine 13:24 Which One When Tools & resources mentioned: - Claude Code: https://www.anthropic.com - OpenHands: https://www.openhands.dev - OpenHands Agent Canvas: https://www.openhands.dev/product/canvas - GitHub Actions: https://github.com/features/actions - AWS Firecracker: https://github.com/firecracker-microvm/firecracker - E2B: https://e2b.dev About The Stack The Stack helps you build with AI. Each video takes one tool, model, or workflow and shows how it works in a few focused minutes, with the real benchmarks and real costs. We go deep on Claude Code and Cursor for AI coding, AI agents and MCP servers, the open-source AI tools and GitHub repos most people miss, RAG and vector search, fine-tuning, and running local LLMs on your own machine with Ollama and LM Studio. We compare models like ChatGPT and Claude, test AI automation with Zapier, Make, and n8n, and flag the tools that actually ship. Subscribe for new breakdowns: https://www.youtube.com/@the-stack-ai?sub_confirmation=1 #coding agents #ai engineering #sandbox isolation