← Back to all posts

Sandboxes Are Hard

AI agents escape sandboxes. The headlines blame the agents. Amjad Masad blames the sandboxes. His argument: sandboxing is extraordinarily difficult, most implementations make fundamental errors, and the only honest security posture is defense in depth — thirteen layers, each assuming the one below it will fail. Compliance is not security. A pen test is a snapshot. Humility is the architecture.

ai-agentssecuritysandboxingdefense-in-depthreplitinfrastructure

AI agents escape sandboxes. The headlines blame the agents. Amjad Masad, CEO of Replit, blames the sandboxes. His argument: sandboxing is an extraordinarily difficult infrastructure problem, and most implementations — including those from dedicated vendors — make fundamental errors. The agent is not the threat. The single layer of isolation pretending to be a security architecture is the threat.

"The first rule of security is humility. Assume zero-days exist — because they do. Assume your isolation will eventually fail."

Masad would know. Replit has run arbitrary, untrusted code since 2016 — surviving attacks from hobbyists, researchers, and state actors. The company's experience is the argument. A sandbox is not a product you buy. It is an architecture you build — layer by layer, each layer assuming the one below it will break.

Having a sandbox is not the same as having a security architecture. The first is a feature. The second is a stack.

Replit's security stack is thirteen layers deep. Zero-trust service-to-service auth. Linux containers hardened with seccomp-bpf. Per-customer GCP Projects for tenant isolation. MicroVM migration underway to eliminate the shared kernel. An append-only Git sidecar — history survives even if the agent deletes .git. A transparent secrets proxy — application code never sees credentials. MCP tool calls scanned for prompt injection. Built-in auth via Clerk — the agent never implements authentication from scratch. Forkable databases so development never touches production. Determinate Nix for supply chain integrity. HackerOne and Trail of Bits for continuous external assessment. An internal AI red-teaming harness that scans, prioritizes, and validates findings before engineers are engaged.

Thirteen layers. Each layer assumes the one below it will fail. When one does — and one always does — the rest hold. This is not paranoia. This is engineering.

The design principle is defense in depth. It is the opposite of trusting a single boundary. A container is not a sandbox. A microVM is not a sandbox. A hypervisor is not a sandbox. Each is a layer of a sandbox. The sandbox is the stack — the accumulated constraints that make the agent's behavior predictable even when one constraint fails.

The stack is the design abstraction. Each layer constrains a region of the failure space. A container constrains host compromise. A microVM constrains kernel sharing. A transparent proxy constrains secret leakage. An append-only sidecar constrains history deletion. No single layer is sufficient. The stack is the accumulated set of constraints.

The agent is non-deterministic. The sandbox is the constraint that bounds the non-determinism. When the agent does something unexpected, the sandbox ensures the unexpected stays contained.

The hardest part of sandboxing is not the technology. It is the posture. You must accept that every layer will eventually fail and build the next one anyway. You must resist the temptation to declare the system secure because it passed a penetration test. Compliance is not security. A clean pen test is a snapshot. The only honest posture: assume compromise, contain the blast radius, monitor continuously, respond fast, harden the root cause, repeat.

The companies that get sandboxing wrong believe their own marketing. The ones that get it right have been attacked for a decade and learned what a single layer of isolation cannot do.


References: