As AI products move from chat interfaces to autonomous agents that write code, run shell commands, and inspect repositories, the security model shifts underneath them. Prompt filters alone cannot secure an agent whose job is to execute arbitrary Python or bash. The real control is the containment boundary around the agent's execution environment.
Where agent containment actually fails
In practice, multi-tenant agent platforms rarely fail through a cinematic kernel zero-day on the first try. They fail at the seams where orchestration, identity injection, and observability meet the guest environment:
- Diagnostic and control-plane sidecars. Guests often share a local network namespace or mount point with a supervisor, logging agent, or telemetry sidecar that holds cluster-wide labels, signing keys, or cross-tenant metadata.
- Inference-proxy and gateway trust. Rather than handing raw model-provider API keys to the guest, platforms route model calls through an internal inference proxy. If that proxy authenticates the caller weakly, fails to scope model routes, or logs unredacted prompts across tenants, the proxy becomes an escalation path.
- Injected credentials and standing privileges. When an environment is provisioned with a cloud role, OAuth token, or repository credential that outlives the task or spans multiple projects, an attacker who hijacks the agent's goal inherits that identity without ever breaking out of the container.
- Persistence past TTL. Ephemeral sandboxes frequently rely on shared caches, warm pool snapshots, or networked filesystems where planted artifacts survive worker recycling.
Separating real escapes from normal guest visibility
A common failure in naive sandbox testing is confusing normal guest configuration with a vulnerability. Discovering that a container has a local scratch disk or can read its own environment variables is not a boundary failure.
To make containment assessments rigorous, we define explicit binary criteria before testing begins. A finding is only recorded when an action from inside an authorised guest proves one of the following:
- Cross-tenant data or identity access: reading another tenant's labels, prompts, files, signing material, or credentials.
- Control-plane or host reachability: reaching internal orchestration APIs, metadata services, or host interfaces that are supposed to be unreachable from the guest.
- Inference-proxy abuse: invoking unauthorised model routes, bypassing tenant spend or policy controls, or reading another session's traffic.
- Lifecycle persistence: surviving environment teardown or polluting a warm pool so a subsequent session inherits attacker state.
- Unauthorised exfiltration: bridging restricted internal state out of an environment whose egress policy is meant to forbid it.
Every test is journaled with the hypothesis, the exact command executed inside the guest, the expected behaviour if containment holds, and the captured output artifact. That discipline gives infrastructure teams concrete proof they can reproduce and fix. Explore our AI infrastructure & isolation assessments to learn more.