# A sandbox without a network boundary is only half a sandbox

DevFeed: [A sandbox without a network boundary is only half a sandbox](<https://devfeed.tech/articles/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox-719.md>)

Original publisher: [Read original article](<https://vercel.com/blog/a-sandbox-without-a-network-boundary-is-only-half-a-sandbox>)

Author: Brandon Tuttle

Published: 2026-08-11T00:00:00Z

Content type: article

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Networks](<https://devfeed.tech/topics/networks.md>), [systems](<https://devfeed.tech/topics/systems.md>), [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [Code](<https://devfeed.tech/topics/code.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [code](<https://devfeed.tech/tags/code.md>), [internet](<https://devfeed.tech/tags/internet.md>), [networks](<https://devfeed.tech/tags/networks.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article explains that safely running untrusted code requires both compute isolation and network isolation. A microVM can protect the host and other workloads, but unrestricted network access still allows code to exfiltrate data, probe internal services, attack internet systems, or misuse available credentials. It presents network egress control as part of the sandbox security boundary and describes network paths, such as DNS resolvers or fail-open policies, that can undermine containment.

## Source excerpt

Running untrusted code safely requires more than separating it from the host. You also have to control what that code can reach. This matters more as AI agents gain the ability to read files, execute commands, install packages, and generate programs of their own. A microVM can prevent that code from accessing the host or another workload. By itself, it cannot stop the code from exfiltrating data, probing internal services, attacking systems elsewhere on the internet, or using credentials available inside the environment. Isolation without egress control contains the process, not its consequences. A complete sandbox therefore needs both compute isolation and control over the authority available through its network: where code can connect, which credentials it can use, and how those permissions change throughout the workload's lifecycle. These controls are part of the security boundary, not protections to bolt on later. A sandbox has more than one boundary Compute isolation answers one important question: what can this program access on the machine where it runs? Network isolation answers another: what can it access, or attack, through the network? Consider an agent that reads a repository and runs generated code. A prompt injection hidden in an issue, log entry, dependency, or source file might instruct it to upload private data. The generated program does not need to escape its microVM. With unrestricted outbound traffic, it can simply send anything it can read to an external server. The same access can be used to scan internal networks, exfiltrate data and credentials, or call an authenticated API. From the attacker's perspective, crossing the VM boundary may be unnecessary. Without a network boundary, it is only half a sandbox. A network bypass can be a sandbox escape Recent security research has made one pattern clear: untrusted code does not need to cross a VM boundary to escape containment. It only needs one network path that the security model failed to accoun