Architecture

Terminal Sandboxing

A fenced-off area where the AI's commands run, so they cannot touch files or websites outside it.

Definition

A security mechanism that restricts file system and network access for terminal commands executed by AI agents. Sandboxed commands have read/write access only to the current workspace, and network access can be limited to trusted domains. Helps mitigate risks from agent-executed commands.

Example

An agent's curl to an unknown domain is blocked and its writes are limited to the project folder, so a bad command cannot wipe your home directory.