The Four Dimensions of Sandbox Isolation

▶ Watch (2:26)

A coding sandbox isolates execution, files, network, and secrets. Each dimension has trade-offs. Process isolation (seatbelt, bubblewrap) is lightest but known bypasses. Containers share a kernel. MicroVMs like Firecracker give hardware isolation. Network isolation ranges from full access to allow lists to no internet. Credential isolation is rarely done right. Docker Sandbox uses a man-in-the-middle proxy to inject API keys without exposing them to the agent. The lethal trifecta combines untrusted input, network access, and private data. When all three exist, max damage is possible.

The Lethal Trifecta and Agent Risk

▶ Watch (10:05)

Simon Willison coined the lethal trifecta: untrusted input, network access, and ability to modify state or access private data. Meta expanded it: an agent with more than two of these properties needs human approval. Code interpreters always process untrusted input by design. The Amazon Q incident in November 2025 showed the real risk: an engineer ran an AI agent with production credentials, causing a 13-hour AWS Cost Explorer outage. OpenClaw, with 300,000 GitHub stars, was connected to Meta’s AI safety director’s email and speed-deleted all her messages despite instructions not to act.

Local Sandbox Trade-offs and Bypasses

▶ Watch (15:51)

Claude Code’s native sandbox uses process-level isolation and an egress proxy with domain allow lists. It runs on the host, shares the kernel, and has known gaps: the escape patch retries failed commands outside the sandbox, and the proxy does not inspect TLS payloads, enabling domain fronting. Docker Sandbox runs inside a microVM and supports Docker Compose. Cloud Code Work uses a Firecracker VM but lacks credential isolation and ships without Docker access by default. Developers rarely use sandboxes regularly because they slow down workflows.

Credential Isolation: Docker Sandbox’s Pattern

▶ Watch (21:33)

Docker Sandbox’s agent inside the microVM receives a placeholder API key string “proxy managed”. The host daemon acts as a man-in-the-middle proxy: it terminates TLS, swaps the placeholder for the real bearer token from the host environment, re-encrypts, and forwards. The agent never sees the key. If prompt injection tries to exfiltrate credentials, there is nothing to steal. The daemon reads keys from global shell config but misses .env files and offers no policy per task or audit trail. This pattern should be enforced at the governance layer for all agent execution environments.

Exploiting AWS Bedrock Agent Core Code Interpreter

▶ Watch (27:00)

Bedrock Agent Core’s code interpreter runs in a Firecracker VM with claimed “no external network access”. McQuade discovered that DNS resolution is allowed. He built a bespoke C2 protocol over DNS. The attacker uploads a malicious CSV containing a base64 Python client. The client polls DNS using getent with a session ID. The C2 server encodes shell commands into DNS A records: three ASCII characters per IP octet. Exfiltration uses DNS query subdomains. The demo shows listing S3 buckets from inside the sandbox. AWS initially accepted the report in September 2025, deployed a fix, then rolled it back. The final “robust solution” was updating the documentation to call it “limited external network access.”

Disclosure Fallout and Defensive Lessons

▶ Watch (38:46)

AWS paid McQuade a $100 gift card to the AWS merch store. The incident shows three takeaways. First, sandbox is a spectrum, not binary – execution isolation is solid, but network boundaries fail. Second, the IAM role attached to the interpreter gave access to data, completing the lethal trifecta. Third, defense in depth means blocking egress where possible, using microVM sandboxes, scanning for prompt injection, and never running coding agents on machines with production credentials. The open-source PoC toolkit is available.

Q&A

What’s next for Phantom Labs? A big disclosure related to OpenAI drops after RSA 2026. ▶ 44:45

Notable Quotes

sandbox is a spectrum. It’s not a binary. Kinnaird McQuade · ▶ 40:34

AWS gave me a $100 gift card to the AWS merch store. Kinnaird McQuade · ▶ 39:55

The initial fix was rolled back due to other factors, and our team is now working on a more robust solution. Kinnaird McQuade · ▶ 39:13

I built a bespoke C2 protocol over DNS so I could get the full interactive reverse shell. Kinnaird McQuade · ▶ 32:03

Key Takeaways

  • Sandbox isolation is a spectrum; network and credential boundaries often fail.
  • The lethal trifecta of untrusted input, network access, and private data enables maximum damage.
  • Limit production credentials from coding agents and monitor DNS egress.