AI Agent Sandbox Threat Model Checklist
A 15-minute threat-model worksheet for deciding whether AI agents need prompt-only rules, workspace allowlists, tool firewalls, ephemeral VMs, or human-gated production controls.
Map blast radius
Read, write, tool-call, egress, spend, and rollback boundaries in one worksheet.
Pick the right tier
Prompt policy, workspace allowlist, tool firewall, ephemeral sandbox, or human-gated production.
Prove controls work
Blocked path, blocked command, network denial, prompt-injection egress test, and rollback drill.
Why this matters now
HN and GitHub signals on 2026-06-11 pointed to compromised agents, accountable agent networks, MCP threat scanners, semantic gateways, and debate over whether teams are defaulting to VM-level sandboxing before understanding their threat model.
15-minute agent sandbox threat model
| Question | Minimum answer | Evidence to keep |
|---|---|---|
| What can the agent read? | Repos, files, browser pages, SaaS records, customer data classes | Data-access register |
| What can it write or change? | Code, configs, workflows, tickets, CRM, billing, production systems | Action-boundary map |
| What can it call? | Shell, browser, MCP tools, APIs, email, deploy, payment, database | Tool inventory |
| What can it exfiltrate? | Network destinations, logs, screenshots, prompts, attachments | Egress allowlist |
| What happens if it is wrong? | Rollback path, approval, kill switch, evidence requirement | Recovery plan |
Sandbox tier selector
| Tier | Use for | Minimum controls |
|---|---|---|
| Tier 0: Prompt-only policy | Internal drafts, low-risk research | No-secrets rule, citations, human review |
| Tier 1: Workspace allowlist | Docs, small code edits, local examples | Path allowlist, diff review, test evidence |
| Tier 2: Tool firewall | Coding agents, browser agents, MCP tools | Command deny list, egress allowlist, budget ceilings |
| Tier 3: Ephemeral sandbox/VM | Untrusted repos, third-party tool bundles | Clean VM/container, no host secrets, artifact review |
| Tier 4: Human-gated production | Deploy, delete, refund, billing/export | Two-step approval, audit event, rollback owner |
Core checklist
- Inventory the agent's read, write, tool-call, network, and spend boundaries.
- Choose the lightest safe isolation tier; do not make VM-level sandboxing the default without a threat model.
- Keep secrets outside agent-readable paths and environment dumps.
- Require approval before deploys, deletes, refunds, charges, email blasts, data exports, and production config changes.
- Run blocked-path, blocked-command, blocked-network, and rollback tests before production access.
Decision record template
Agent/tool: Owner: Primary job: Data classes accessible: State-changing actions allowed: Selected sandbox tier: Why this tier: Explicit denials: Approval-required actions: Egress destinations allowed: Budget ceiling: Run-log location: Rollback/kill-switch owner: Next review date:
Turn this into a paid control-plane sprint.
Pair the sandbox threat model with the OperatorForge AI bonuses for local firewall, authorization boundaries, observability, rollback, verification, instruction governance, skill security, and cost controls.