RUNTIME EXECUTION ENVIRONMENTS

THE SANDBOX A sandbox is an isolated, restricted place to run code safely. The name comes from a child's sandbox, where a child can dig, build, and make a mess without harming the rest of the garden. Inside a software sandbox, a program can run but is blocked from seeing or changing anything outside the box, except what the engineer deliberately allows. Sandboxes matter for agents because agents increasingly write and run code, and code written by a model may contain bugs. Worse, an attacker may trick the agent into running harmful code, a danger you will study in Part Nine. A sandbox limits the blast radius, meaning how much damage a single failure can cause. Strong sandboxes follow a principle called least privilege, which means giving a program only the smallest set of abilities it needs and nothing more.