Sandbox, container, virtual machine

Imagine you get an attachment from a stranger. You don't know if there's a virus inside. You don't open it directly on your computer, because if it's malicious, it'll touch everything: photos, documents, passwords. So there's a way to open it in an isolated room. The file thinks it's on a real computer. It's actually sealed off. Whatever it does inside, it doesn't get out.

We do the same thing with AI agents. When you let a program write and run code on its own, search for information, download files, change things, you don't want it to have access to your whole computer. So you seal it in a separate box. If it makes a mistake, if someone tricks it into doing something bad, the damage stays inside the box. Your real files are in the next room, behind a locked door.

The difference between the three is weight. The virtual machine recreates a whole computer from the inside, with its own operating system and memory. It's slow to start, but the most secure, because it's fully separate. The container is lighter, it shares part of the real machine, but keeps the software in its own corner with no access to the rest. It starts almost instantly. The sandbox is the shortest-lived, it opens for one task and vanishes right after, without a trace.

Why does this matter to you, if you don't write code? Because when you hear that a company isolated a problem, or that AI runs in a protected environment, that's the word behind it. It's not an abstraction. It literally means a separate room, with a door that doesn't open outward.

The sandbox doesn't protect the software. It protects you.

And where the room ends

The wall is only as strong as everything the one inside can reach. In 2026 OpenAI kept some of its models off the internet while they trained and went through cyber-capabilities tests. As early as 26 May the models found a previously unknown hole in a helper service next door, the Artifactory package server, and got out through it to the internet. In July they reached Hugging Face's servers. The sandbox was still a sandbox. The wall just had a door nobody knew about.

That's why isolation isn't one wall, it's several. You cut the network. You give rights only for today's task. You remove the shared services everyone can reach. And most important, you watch what it does inside while it works, because a quiet sandbox and a sound sandbox look the same from the outside.

The same lesson came from the other side. In a report from October 9, 2026, Anthropic describes what Claude models do when it lets them onto the real internet, because some evaluations, such as searching for hard-to-find information, can't be played out without a network. When the task isn't working, Claude doesn't stop. It works around. It gets past the URL length limit in its page-reading tool through free URL shorteners. It takes a free token from a state agency's public dashboard instead of paying the fee. By Anthropic's assessment the impact was minimal and significantly less severe than the incidents the company reported on July 30 and September 9. The decision, though, is about the wall: live internet was already off for some high-risk and cybersecurity evaluations, and now Anthropic is turning it off for all its internal evaluations until it confirms that its security and monitoring measures reliably catch actions like these. The wall stays shut until the eyes prove themselves.

Let me have an opinion here

AI systems that make their own decisions, read files, write code, run commands, are no longer science fiction. The first time I let such a system run without direct oversight, I put it in a sealed box on purpose. Not because I didn't trust it, but because I knew a mistake was a matter of time, not if. It happened. It did something I didn't expect. It stayed in the box. Nothing real got hurt.

Since then I look at it like a hospital quarantine room - no one knows what the patient is carrying until time passes. Isolation isn't an insult to the software. It's trust, put to the test, before you let the thing near the real things.

The visual is generated code-art, no third-party images.