What is a sandbox?
A sandbox is a confined environment in which software or AI can run without being able to affect other systems or data.
Software in the sandbox reaches only what has been explicitly allowed. If something goes wrong, or the software turns out to be harmful, the consequences stay within the boundaries.
With AI, sandboxes are used when an AI agent needs to run code, open files or use the web. The agent can work freely inside the sandbox while the organisation's other systems stay protected.
The word is also used in another sense. The EU AI Act requires each member state to set up a regulatory sandbox in which AI can be developed and tested under supervision. According to PTS, the Swedish one is to be in place by 2 August 2027.
How it works
A sandbox can be built in different ways, such as a separate container, a virtual machine or a browser that runs in isolation. What they share is that network, files and permissions are restricted, and that the environment can be wiped afterwards.
Here is an example. An agent is asked to analyse a spreadsheet from an unknown sender. In the sandbox it can open the file and run calculations, but it reaches neither the email nor the file server.
Why it matters
An AI agent that runs code does things nobody has reviewed in advance. The sandbox makes it possible to benefit from that without giving the agent access to everything. It complements least privilege, which limits what the agent may do outside the sandbox.
What to keep in mind
A sandbox is as secure as its boundaries. Check which network connections are open and what is copied in and out.
For the most sensitive environments it can make sense to run the entire AI solution without an internet connection. Read more about the air gap.
What it means for you
Let AI agents that run code or handle files from unknown sources do so in a sandbox. It limits what a mistake or a manipulation can cost.
Common questions
Is a sandbox the same as a test environment?
They are similar. A test environment is for trying changes before they go live. A sandbox is a security boundary that can also be used in live operation.
What is a regulatory sandbox?
An environment where companies can develop and test AI under the guidance of an authority. The EU AI Act requires every member state to set one up. Read more about the EU AI Act.
Sources: NIST on sandboxPTS on the AI Act (in Swedish)
Related terms
Read more
All terms Updated