Markdown source

AI Sandboxes

Overview

AI sandboxes are controlled execution environments where agents can run code, browse, inspect files, call tools, or manipulate artifacts without putting the host system at unnecessary risk. A sandbox gives the agent enough power to do real work while limiting filesystem, network, credential, and process access.

Conference Context

The pattern comes from operating-system isolation, browser sandboxes, CI runners, notebooks, container platforms, and secure code-execution services. Agentic coding and computer-use systems made sandboxing a default requirement rather than a specialty feature.

How This Theme Evolved

Confidence: high. Boundary: Earlier event wikis are comparison context only. They are not primary evidence for World's Fair 2026 claims, and no local fixture is represented as a public live site. Comparison source: aie wiki generation delta.

Significance

Agents need to experiment, test, and inspect state. Sandboxes let them do that while containing failures, malicious inputs, runaway processes, and accidental destructive changes.

Why This Matters Now

Agents increasingly execute code and use credentials rather than only returning text, so correctness and blast-radius control must be designed together.

WF26 evidence gate: this section was emitted only because the page links to configured local evidence. Relevant configured evidence: 2026 06 30 robert brennan sandboxes aren t optional runtime isolation patterns for coding agents at scale, 2026 06 30 samuel colvin your agent needs a sandbox not a desert.

Confidence: high. Comparison history is context; linked WF26 pages remain the evidence for current-event claims.

Applied Use

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Choose isolation based on risk: separate processes for low-risk tasks, containers or microVMs for untrusted code, and policy-controlled network and secret access for production work. Capture logs, diffs, artifacts, and resource usage so human operators can review what happened.

They are useful in coding assistants, data-analysis agents, browser agents, app builders, test runners, educational tools, and any system that executes generated code or commands.

Use a sandbox whenever an agent can execute code, inspect user files, download dependencies, browse unknown sites, or run untrusted scripts. Loosen limits only after the workflow and threat model are well understood.

Practical Lesson

Give each run the minimum tools, credentials, network reach, filesystem scope, and lifetime it needs; capture actions and outputs so approval and incident review use the same evidence trail.

Confidence: high. Treat this as synthesis derived from the linked evidence graph, not as an official schedule claim.

Connections

Evidence Graph

Transcript-backed resources

Quote signals

Transcript-backed resources

Transcript-backed resources

Transcript-backed resources

Transcript-backed resources

Transcript-backed resources

This evidence graph consolidates scheduled talks, linked videos, transcripts, and slide-derived material connected to this topic.

Linked Sessions

Media Signals

Source Coverage

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

| Evidence type | Count | Review note |
| --- | ---: | --- |
| other | 40 | Related pages outside the main evidence categories. |
| resources | 22 | Video/resource pages; check source status before treating as primary event evidence. |
| slides | 16 | OCR or reconstructed slide evidence; mark claims as OCR-derived unless image-reviewed. |
| talks | 24 | Official schedule pages; use for titles, speakers, tracks, and stated talk framing. |
| tools | 5 | Derived inventory pages; use as entity context, not independent proof. |

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

| other | 44 | Related pages outside the main evidence categories. |
| resources | 24 | Video/resource pages; check source status before treating as primary event evidence. |
| talks | 26 | Official schedule pages; use for titles, speakers, tracks, and stated talk framing. |

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

| resources | 25 | Video/resource pages; check source status before treating as primary event evidence. |

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

| other | 45 | Related pages outside the main evidence categories. |
| resources | 26 | Video/resource pages; check source status before treating as primary event evidence. |
| slides | 17 | OCR or reconstructed slide evidence; mark claims as OCR-derived unless image-reviewed. |

Talks

Resources

Slides

Tools

This table summarizes the local evidence already linked from this topic. It is a navigation aid, not a claim that every linked page has been fully reviewed.

| resources | 27 | Video/resource pages; check source status before treating as primary event evidence. |

Talks

Resources

Slides

Tools

Active Use Cases

Slide-Derived Supporting Decks

These decks are slide/OCR support only; keep the article synopsis, origin, use cases, and schedule sections as the primary topic narrative.

Slide-Derived Scheduled Session Signals