In short
- Anthropic's September 2026 report describes an actor injecting instructions into a vendor sandbox and extracting production API keys from multiple providers.
- A sandbox has 4 boundaries and most implementations hold 1: process isolation. Credentials, network egress and time are usually unbounded.
- Egress is the boundary that decides whether stolen data leaves. An allowlist of destinations turns exfiltration into a failed connection.
- Time matters because agents run unattended on schedules. A run without a wall clock limit is a run without a worst case.
- Article 15 of the AI Act asks for resilience against exploitation attempts, which is a documented boundary rather than a product name.
Sandboxing is the answer teams give when asked what stops an agent doing damage. It is a good answer to a narrower question than the one being asked.
Isolating a process stops the process reaching the host. It says nothing about what the process is holding.
01What did the vendor sandbox case show?
That the sandbox can be the target rather than the control.
Anthropic’s September 2026 threat report describes an actor injecting malicious instructions into a vendor sandbox and obtaining production AI API keys belonging to several providers. The isolation worked in the conventional sense. Nothing escaped onto the host. The credentials walked out through the front door because the sandbox was allowed to hold them, which is the argument for treating an AI key as a production credential.
This is the shape of the problem. Containment of execution and containment of authority are different properties, and only one of them is what people buy.
02Which four boundaries matter?
| Boundary | Usual state | What it prevents when held |
|---|---|---|
| Process and filesystem | Held | Host compromise from the workload |
| Credentials reachable | Open | 1 stolen key funding the next stage |
| Network egress | Open | Exfiltration of anything read |
| Wall clock and spend | Open | Unbounded worst case per run |
The first row is the one every platform advertises. The other three are configuration decisions that default to convenient, because a sandbox that cannot reach the internet breaks the first integration someone tries.
03Why is egress the highest value boundary?
Because data theft requires a destination.
An agent inside a strict egress allowlist can still be persuaded to read everything it has access to, because no defence brings the prompt injection rate to zero. It cannot send that anywhere the allowlist does not name. The attack succeeds and produces nothing, which is the definition of a control that degrades well.
Egress control is also the cheapest to evidence. A deny by default policy with a named list of destinations is a configuration artefact with a date on it, which is exactly the sort of thing an assurance function can sample and an auditor can read.
04What about time and spend?
They set the worst case, and Anthropic’s September 2026 threat report shows why that matters.
| Bound | Unbounded default | Bounded version |
|---|---|---|
| Wall clock per run | Until it finishes | Explicit limit, 1 per task type |
| Tool calls per run | No cap | Numeric cap with alerting |
| Spend per key per day | Account limit | Per project limit |
| Concurrent runs | Whatever scales | Capped per identity |
In the cases Anthropic reported, a fleet of 13 collection agents ran on a pre-set schedule with no human in the loop, and one workflow iterated continuously for a month. That is a description of attacker tooling and also of ordinary automation. A run with no time limit has no worst case, only an eventual one.
05Which provisions does a boundary statement answer?
| Requirement | Provision | Applies from |
|---|---|---|
| Resilience against exploitation attempts | Article 15 | 2 Dec 2027 |
| Automatic recording of events | Article 12 | 2 Dec 2027 |
| Effective human oversight | Article 14 | 2 Dec 2027 |
| Prompt injection ranked first | OWASP LLM01 | 2025 edition |
For AI embedded in Annex I regulated products, read 2 August 2028 in place of the dates above.
06How should this be written down?
As a boundary statement per agent, in four lines.
What credentials it can reach, which destinations it may contact, how long a run may last, and what it may spend. Four values, reviewed when the agent’s job changes.
Article 15 requires high-risk systems to be resilient against attempts by unauthorised third parties to exploit vulnerabilities. It does not name sandboxes and will not. A four line boundary statement, with the configuration that implements it, is the artefact that answers the question the provision asks.
07Frequently asked questions
What does an agent sandbox need to contain?
Four things: the process, the credentials it can reach, the network destinations it can contact, and how long it may run. Most sandboxes isolate the process and leave the other three open, which contains the code but not the consequences.
Why is network egress control the most valuable boundary?
Because exfiltration needs a destination. An agent that can read sensitive data but can only reach an allowlist of known endpoints cannot send that data anywhere useful, which converts a data breach into a failed outbound connection.
Can a sandbox stop prompt injection?
No. A sandbox does not affect whether the model is persuaded; it affects what the persuaded model can reach. Those are different controls, as with [scope and approval gates](/least-privilege-for-autonomous-agents/), and the second one is the one that still works after the first has failed.
What did the vendor sandbox incident show?
That a sandbox is part of your attack surface, not only your defence. In the case Anthropic reported in September 2026, malicious instructions were injected into a supplier's sandbox and production API keys belonging to several providers were obtained from it.
08References and method
- Anthropic, Detecting and countering misuse of AI: September 2026, for the vendor sandbox case (actor GTG-50020), the agent fleets running on pre-set schedules with no human in the loop, and the recommendation to treat AI keys as production credentials.
- OWASP Top 10 for LLM Applications, 2025 edition, LLM01:2025 Prompt Injection, for prompt injection ranked first and for the treatment of it as an open class.
- Regulation (EU) 2024/1689, Article 15, for the resilience requirement applying to high-risk AI systems.
- The four boundary framework is editorial, prepared by The Guardrail from ordinary isolation practice. It is not drawn from a published standard.