Agent sandbox
Also written execution container
An isolation boundary around the commands an agent runs — an operating-system sandbox profile, a container or a microVM — that limits which files they can write and which hosts they can reach, whatever the agent decides. It bounds the damage of a bad action rather than judging the action, and it sees system calls and connections rather than intent, so it cannot tell an approved upload from exfiltration to the same allowed host.
How MoorAI handles it: MoorAI turns the egress rules it enforces into network policy for the Windows MXC sandbox, macOS Seatbelt and OpenShell, so one rule set drives both layers.
See also least privilege for AI agents · action layer · data exfiltration
Related terms
-
Least privilege for AI agents
Defence & response
The principle that an agent gets only the tools, files, network destinations and credentials its task needs, for only as long as it needs them.
-
Action layer
Agents & architecture
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.
-
Data exfiltration
Attack concepts
Moving data the attacker should not have out to somewhere they control. In agent contexts the channel is rarely a file upload — it is a URL the agent is…
Agents & architecture
Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.