[Projects]() / Agent Sandbox Boundaries # Agent Sandbox Boundaries An ephemeral Wasmtime runner that makes CPU, wall-time, guest-memory, filesystem and network capability limits observable. Author: [Lucio Durán]() · Python 3.11.9 and Wasmtime 50.0.1 · License: [MIT]() Page published: 2026-11-09 · Page updated: 2026-11-09 [Repository]() · [Original evidence]() · [Release v0.1.0]() ## Problem and relevance to agents A timeout on a subprocess does not prevent filesystem access, network egress or memory growth by generated code. The actual isolation mechanism must be explicit. The runner executes bounded binary core WebAssembly with a narrow WASI interface and rejects unsupported policy requests instead of ignoring them. ## Architecture 1. **Validate the policy.** Accept only bounded binary Wasm, zero guest disk writes, denied network access and supported guest-memory limits. 2. **Enforce with Wasmtime.** Fresh worker and store, POSIX CPU limits, instruction fuel, guest memory and table bounds, and a parent wall deadline. 3. **Withhold ambient capabilities.** WASI Preview 1 receives no inherited environment, arguments, files, directories or sockets. Workers and temporary directories are cleaned up. - [Design and trust boundaries]() ## What this demonstrates - Controlled traversal and resource-limit probes against owned synthetic canaries. - Explicit failure for unsupported positive disk quotas, network access and process-memory caps. - Recorded policy, module hash and observed outcome for every boundary probe. ## Published results Nineteen boundary probes and three unsupported-profile checks ran once on an Intel Xeon W-3223, 48 GiB RAM, Python 3.11.9 and Wasmtime 50.0.1. The matrix checks expected statuses and values, canary integrity and absence of created files. CPU and wall probes ran under the shared exclusive benchmark lock. ### Observed isolation boundaries | Boundary | Observed result | | --- | --- | | CPU and execution | Fuel exhaustion and OS CPU termination | | Wall time | Blocking WASI poll stopped at parent deadline | | Guest memory | Growth denied; oversized memory rejected; invalid access trapped | | Filesystem | Traversal, canary access and file creation returned bad descriptor | | Network | Socket send denied; socket creation import rejected | | Lifecycle | Empty arguments and environment; fresh instance state | | All recorded outcomes | 19/19 matched | | Unsupported profiles | 3/3 rejected | Wasmtime provides the isolation mechanism; the subprocess provides lifecycle and deadline control. These observations are synthetic regression evidence, not a security certification or escape-proof guarantee. ## Reproduce Python 3.11.9 on macOS or Linux, with pinned Wasmtime 50.0.1. Install the repository requirements before running checks. The stress command uses the original shared workspace lock. On another installation, supply an equivalent exclusive lock around the same experiment module. Do not run concurrent stress workloads; use a fresh output path. The non-stress regression command is separate. ### Check the supported boundaries ``` git clone https://github.com/lucioduran/agent-sandbox-boundaries.git cd agent-sandbox-boundaries git checkout f67487bb807ca84bb1801eaee7cc81f072f71ac4 python3.11 -m venv .venv . .venv/bin/activate python -m pip install -r requirements-dev.txt python -m pytest -q -m 'not stress' ``` ### Repeat the local experiment ``` OMP_NUM_THREADS=1 MKL_NUM_THREADS=1 OPENBLAS_NUM_THREADS=1 python3 /Users/luchoduran/Sites/open-source-projects/.coordination/benchmark_lock.py .venv/bin/python -m experiments.reproduce --output build/new-boundaries.json ``` ## Scope and limitations - Memory bounds cover guest linear memory, not total worker RSS, compiler allocations or all host memory. - The runtime and operating system are trusted. A compromised engine is outside this boundary. - No writable filesystem mounts, positive disk quotas, output capture or network allowlists are supported. Network evidence checks denied capabilities, not packet-level firewall behavior. - Only core Wasm with WASI Preview 1 on macOS and Linux is supported. Windows and Preview 2 components fail closed. Callers must bound concurrency. - [Related architecture article]() ## Sources and revision The report records execution time, implementation revision and source/module hashes. The reviewed release contains that evidence. Absolute-canary probe hashes depend on the original temporary canary path. - Reviewed revision: [` f67487bb807ca84bb1801eaee7cc81f072f71ac4 `]() - Revision recorded by the experiment: [` bdffaf85ff10f9e28682592af0c9d041c04862f7 `]() - Report timestamp (UTC): 2026-11-09T18:32:32.705508+00:00 - Release published: [v0.1.0]() · 2026-11-09T18:34:04Z - [README and usage]() - [Original evidence]() - [MIT license]() - [Design and trust boundaries]() - [Results summary]() - [Boundary probes]()