Why agent runtime sandboxes belong in your security review
Gateways control which tools an agent calls. Sandboxes control what happens when tool code or plugins run. Here is what to ask before you let agents touch production data.
This week's headlines roundup flagged runtime sandboxes on vendor security questionnaires. That is the right focus. An MCP gateway can block a bad tool call and still lose if the tool implementation runs with too much privilege on the host.
Think of it in two layers: policy at the gateway (what is allowed) and enforcement at runtime (what actually executes). You need both for customer-facing or financial workflows.
What "sandbox" should mean in 2026
A useful agent sandbox is not "we run in Docker somewhere." It should guarantee, per session or per tool invocation:
- No host filesystem except an ephemeral scratch dir with size caps.
- Egress allowlist only (your APIs, not the open internet).
- CPU and memory limits with hard kills on runaway loops.
- Secrets injected per call, not baked into the image.
- Clean teardown when the session ends (no cross-customer residue).
WASM and microVM approaches are popular because startup time matters for chat. The technology label matters less than whether your pen tester can break out or exfiltrate data laterally.
Questions for security and procurement
- Where does tool code run relative to your VPC or tenant boundary?
- Can a malicious document in RAG influence code execution paths?
- What network destinations are reachable from inside the sandbox?
- How are OAuth tokens scoped and rotated for each agent principal?
- What logs prove which sandbox instance handled which user request?
- How fast can you drain or kill all sandboxes for one compromised agent?
Pair answers with your MCP gateway checklist and agent identity model. Gateway without sandbox is policy on paper. Sandbox without gateway is ungoverned tools with a fancy box.
Common gaps we see in reviews
- Shared worker pools across tenants with only logical separation.
- Browser automation running on a desktop with full network access.
- Plugins installed by admins that bypass gateway scopes.
- Long-lived sessions that reuse memory across unrelated users.
These show up in the same reviews as agent detection gaps. Fixing detection without isolation leaves you logging a breach in progress.
A practical rollout sequence
Week 1: map every place agent code executes today (vendor SaaS, your VPC, laptops).
Week 2: move one read-only tool into a sandboxed path in staging.
Week 3: run a pen test focused on breakout and egress.
Week 4: document results for insurance and customer disclosure packets.
You do not need perfect isolation on day one. You need one production workflow where compromise stays contained, with logs your team can replay.
How Swift Media thinks about this
Jarvis agents run with explicit scope, channel oversight, and dispatch logs. Sandboxing and human approval reinforce each other: the runtime limits blast radius, the gateway limits tools, and the human queue limits irreversible writes. If you want help scoping a sandbox pilot for one business unit, talk with us.