The core rationale behind BoxAgnts choosing WebAssembly sandboxing: "capability-based injection" rather than "permission reduction."
What exactly does the Wasmtime sandbox isolate? Where are the boundaries of each layer of defense? And why are typical attack vectors ineffective against this model?
Why Traditional Sandboxes Are Patchwork
Take Docker as an example. Its security model relies on Linux namespaces (UTS, PID, mount, network, IPC, user, cgroup) combined with seccomp profiles. This combination works reasonably well at the application level, but for AI Agent tool scenarios, several problems emerge.
The first problem is the inherent flaw of syscall blacklists. seccomp's default behavior is "allow all syscalls, only block the specified list." Docker disables approximately 44 syscalls by default (reboot, kexec_load, add_key, etc.). If a newly discovered dangerous call isn't on the list, the protection is non-existent. More critically, AI model-driven tool invocation behavior is unpredictable — a human developer wouldn't write code that calls ptrace on other processes, but a bash command generated on the fly by an AI might accidentally trigger an unblocked syscall.
