There's a growing unease in the dev community right now: we keep handing AI agents more tools — shell access, file writes, HTTP clients, git push — and mostly we check the boundaries by vibes. The agent didn't delete anything today, so the sandbox works, right?
I wanted something more defensible than vibes. So this article is a small, runnable red-team suite you can point at any environment where you let an agent execute commands. It doesn't assume any particular agent, model, or vendor. It tests the sandbox, not the model — which is where most real failures live.
Everything below is reproducible. The test suite is code you can run. The failure modes are described, not dramatized.
The four boundaries that actually matter
When people say "sandbox," they usually mean one blurry thing. In practice an agent execution environment has at least four separate boundaries, and each fails differently:
