AI coding agents are untrusted system components that run directly in the host’s terminal. Before sandboxing an agent, therefore, one must first ask: what threats am I sandboxing against, and who is the adversary?
An agent might be prompt-injected, directly or indirectly, by external sources, or it might hallucinate dangerous actions during its own inference. Why the agent turns hostile is immaterial: the threat model treats the agent as a fully privileged adversary inside the sandbox regardless of cause.
Below are excerpts from my MS Cybersecurity (Georgia Tech) capstone report: SideKernel. In this threat model, the adversary is the agent itself.
See the preprint on arXiv: https://arxiv.org/pdf/2610.02456
To study the attack surface of AI agents in the context of sandboxing, I define two security boundaries, depicted in Fig. 1.
NORTH BOUNDARY: The north boundary encompasses all communication between the agent inside the sandbox and machines other than the host, including the internet and other hosts on the same or external networks. I refer to the communication channel from the sandbox to the north boundary as the NORTHBOUND CHANNEL.
SOUTH BOUNDARY: The south boundary encompasses all communication between the sandbox and the host. Depending on the sandbox implementation, this may include virtual sockets, network protocols such as SSH, network traffic addressed to the host, and filesystem shares mounted from the host. I refer to the communication channel from the sandbox to the south boundary as the SOUTHBOUND CHANNEL.
The south boundary protects the host from malicious actions such as installing malware or deleting or modifying valuable files. The threat is unidirectional, from the sandbox towards the host; a compromised or malicious host is out of scope.
The north boundary protects the data mounted inside the sandbox from exfiltration, for example a malicious agent sending all mounted data to an external endpoint. It equally protects external entities from a malicious local agent. Here the threat is bidirectional: the agent may attack or leak data outward, and hostile external content may reach the agent inward.
A notable example is the July 2026 incident in which an OpenAI agent under evaluation escaped its sandbox and breached Hugging Face’s production infrastructure [1]. It illustrates how difficult it is to sandbox powerful agents: the agent bypassed northbound controls by discovering and exploiting a zero-day in the package registry cache proxy, one of its permitted egress paths, and chained further vulnerabilities to escape the sandbox and its local network and reach the internet.
SideKernel’s security controls address both boundaries, though not equally.
South Boundary Threat Model: On the south boundary, the goal is to protect the host’s runtime and its non-mounted filesystem from adversarial agents running inside the sandbox.
North Boundary Threat Model: On the north boundary, the goal is to prevent exfiltration of sandbox data to the internet or other external networks and endpoints, and to prevent a malicious agent from using the sandbox as a launch point for outbound offensive operations.
In this light, it becomes clear that sandbox design needs protections at both the north and the south boundary.
One might even claim that south boundary protection is a solved problem, at least architecturally; in practice, implementation bugs still lead to sandbox escapes (e.g., CVE-2026-77179). The north boundary is more granular and more complex, and as an industry we have not yet solved it sufficiently.
Try SideKernel
SideKernel is my answer to this threat model: an open-source microVM sandbox for AI coding agents on macOS, built on Apple’s Virtualization.framework. Each agent runs in its own lightweight VM with its own kernel, so a hostile agent has to break hardware-backed virtualization, not just a container, to reach your host. It supports Claude Code (and now Codex) out of the box and is built for intuitive and easy to use everyday developer workflows.
🔗 sidekernel.com (full report included)
⭐ github.com/minoansecurity/sidekernel
Feedback, issues, and contributions are welcome!
—-
[1] OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation,” Jul. 2026, accessed: Jul. 28, 2026. [Online]. Available: https://openai.com/index/ hugging-face-model-evaluation-security-incident/