2 min lesson
Assume the sandbox breaks
Match each case in "Assume the sandbox breaks" to the signal and response that fit it.
Step 1 of 2
Assume the sandbox breaksdefense in depth, designed around the blast radius
Every isolation layer has a nonzero chance of being escaped. A mature design accepts that and asks the next question: when this sandbox is breached, what does the attacker reach? The answer should be "almost nothing of value."
The sandbox holds no long-lived prod credentials.
If it needs cloud access, give it a narrowly-scoped, short-lived token for that one task.
Default-deny egress; allowlist only what the task needs.
Block the metadata endpoint and internal service CIDRs outright.
One sandbox per task, destroyed after.
No shared state between runs, so a compromise can't persist or poison the next user.
A compromised agent sandbox is annoying. A compromised sandbox that can reach production secrets, the metadata endpoint or another customer's data is a breach. Design so the worst case of an escape is "they trashed a disposable box," by making sure that box never held anything worth stealing and couldn't route to anything that did.
When asked how you'd run agent-generated code, don't just say "a container." Lay out the spectrum, pick a microVM or gVisor with a reason (per-task isolation at acceptable latency), then pivot to defense in depth: "I assume it can be escaped, so the sandbox has no standing secrets, default-deny egress including the metadata endpoint and it's destroyed after one task." Naming the post-escape blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. is what reads as senior.