AI coding agents are getting more tools: shell execution, file writes, network calls, package installs. The uncomfortable question underneath all of it is simple — what happens when the boundaries fail?
Not malicious failure, necessarily. The mundane kind: an agent asked to "clean up build artifacts" that interprets your home directory as a build artifact. An agent that "fixes the test" by deleting the test. An agent that exfiltrates your .env because some dependency's postinstall script told it to.
Most of us evaluate agents by whether the output looks right. Almost nobody evaluates them by what they touched along the way. This article is a small, reproducible harness for doing exactly that: a set of trap files, sentinel environment variables, and network tripwires you can drop into a sandbox, point an agent at, and get a boundary report instead of a vibe.
What we're actually testing
When I say "boundary," I mean four concrete claims we usually make implicitly about an agent environment:
