{
  "id": "sandboxed-execution",
  "type": "entity",
  "name": "Sandboxed execution environments",
  "summary": "Contained environments where an agent can act — run code, call tools, mutate state — without its failures reaching production systems. Execution-graded benchmarks already presume one; for dangerous-capability testing the sandbox is the safety case. A sandbox that leaks (network egress, shared state, real credentials) converts a test failure into an incident.",
  "locale": "en",
  "tags": [
    "sandbox",
    "isolation",
    "execution",
    "safety"
  ],
  "relations": [
    {
      "rel": "explained_in",
      "target": "designing-an-agent-sandbox"
    },
    {
      "rel": "enables",
      "target": "fault-injection-for-agents"
    }
  ],
  "questions": [
    "Why do agent evals need a sandbox?",
    "What does an execution environment for agent testing look like?"
  ],
  "claims": [
    {
      "id": "c1",
      "text": "SWE-bench grades by execution: resolving real GitHub issues requires the model to edit codebases and interact with execution environments, so the environment is part of the benchmark's design.",
      "sources": [
        "swe-bench"
      ],
      "confidence": 0.9
    },
    {
      "id": "c2",
      "text": "METR built Hawk, an open-source platform for large-scale AI agent evaluations on Inspect infrastructure — evidence that serious agent evaluation is an infrastructure problem, not a prompt problem.",
      "sources": [
        "metr"
      ],
      "confidence": 0.85
    },
    {
      "id": "c3",
      "text": "Dangerous-capability evaluation domains include cybersecurity and self-proliferation, where the evaluated behavior is exactly the kind that must not escape the test environment.",
      "sources": [
        "deepmind-dangerous-capabilities"
      ],
      "confidence": 0.85
    }
  ],
  "takeaways": [],
  "faqs": [],
  "evidence_tier": "secondary",
  "evidence": {
    "level": "industry_observation",
    "source_types": [
      "industry_observation",
      "paper"
    ]
  },
  "moat_flag": false,
  "winning_edge": "States the failure conditions of a sandbox (egress, shared state, real credentials) as testable properties and links to a build guide, rather than treating \"use a sandbox\" as self-explanatory advice.",
  "confidence": 0.8,
  "last_verified": "2026-08-08",
  "canonical_url": "https://agentreliability.dev/k/sandboxed-execution",
  "api_url": "https://agentreliability.dev/api/k/sandboxed-execution.json",
  "jsonld": {
    "@context": "https://schema.org",
    "name": "Sandboxed execution environments",
    "description": "Contained environments where an agent can act — run code, call tools, mutate state — without its failures reaching production systems. Execution-graded benchmarks already presume one; for dangerous-capability testing the sandbox is the safety case. A sandbox that leaks (network egress, shared state, real credentials) converts a test failure into an incident.",
    "url": "https://agentreliability.dev/k/sandboxed-execution",
    "license": "https://spdx.org/licenses/CC-BY-4.0.html",
    "dateModified": "2026-08-08",
    "citation": [
      {
        "@type": "CreativeWork",
        "name": "SWE-bench: Can Language Models Resolve Real-World GitHub Issues?",
        "url": "https://arxiv.org/abs/2310.06770"
      },
      {
        "@type": "CreativeWork",
        "name": "Evaluating Frontier Models for Dangerous Capabilities",
        "url": "https://arxiv.org/abs/2403.13793"
      },
      {
        "@type": "CreativeWork",
        "name": "METR — Model Evaluation & Threat Research",
        "url": "https://metr.org/"
      }
    ],
    "author": {
      "@type": "Person",
      "name": "Santiago Santa María Morales",
      "jobTitle": "practitioner — harness engineering and agent evaluation in production"
    },
    "@type": "Article",
    "headline": "Sandboxed execution environments"
  }
}