Skip to main content
Secure Sandboxes are isolated execution environments where agents perform hands-on security work. Every time a task requires running commands, executing scripts, fetching URLs, compiling proof-of-concepts, or performing reconnaissance, the agent operates within a sandboxed environment to ensure safety, reproducibility, and controlled execution.

​
Purpose and architecture

Sandboxes serve as the protective execution layer between your infrastructure and agent operations. They provide:
  • Isolation: Each task runs in a completely isolated environment, preventing any potential impact to your host systems or network
  • Consistency: Pre-configured with security tools, CLI utilities, compilers, and dependencies needed for security workflows
  • Safety: Network access, system calls, and resource usage are controlled and monitored throughout execution
  • Observability: All execution logs, outputs, and artifacts are captured in real-time and streamed back to the conversation

​
How execution works

When an agent needs to perform an action, here’s what happens:
  1. Environment initialization: A fresh sandbox environment spins up with the necessary tools and dependencies
  2. Credential injection: Environment variables and secrets you’ve defined are securely injected into the sandbox process at runtime, never written to disk
  3. Task execution: The agent runs commands, scripts, or tools within the isolated environment
  4. Live streaming: Output, logs, and progress are streamed back to you in real-time as the task executes
  5. Artifact capture: All generated files, reports, screenshots, and evidence are automatically saved
  6. Cleanup: The ephemeral sandbox environment is destroyed after execution completes

​
Persistent disk storage

While the sandbox environment itself is ephemeral and destroyed after each run, all generated files and artifacts are persisted to a dedicated storage layer that runs alongside the sandbox. This persistent disk ensures:
  • File continuity: Every file created during execution (scan results, reports, screenshots, logs, compiled binaries) is automatically saved to persistent storage
  • Cross-task access: Files generated in one task remain available for future tasks, enabling agents to build on previous work
  • Evidence preservation: Complete audit trails and artifacts from security assessments are retained for review, reporting, and compliance
  • Workspace persistence: Your agent’s workspace maintains state across executions, so context and results accumulate over time
This architecture gives you the security benefits of ephemeral, isolated execution while maintaining the practical benefits of persistent storage for all your security artifacts and findings.