AI Agents in Isolated Containers: Architecture, Technologies, and Evolution

AI Agents in Isolated Containers: Architecture, Technologies, and Evolution

Abstract

In the current artificial intelligence ecosystem, autonomous agents have evolved from simple conversational assistants to systems capable of executing code, manipulating files, generating complex documents (DOCX, PPTX, PDF), and navigating the web autonomously. This evolution has posed a fundamental security challenge: how to allow these agents to perform high-impact tasks without exposing host systems, sensitive data, or underlying infrastructure to security risks. The answer has been the development of isolated containers—ephemeral, tightly confined execution environments where agents can operate with limited freedom, without compromising the integrity of the host system. This article examines the architecture of these infrastructures, the technologies that underpin them, the mechanisms enabling ultra-fast startup, and the historical evolution of this paradigm, with special attention to implementation cases on leading platforms such as Anthropic, Kimi, and Brightwave.

1. Introduction and Problem Statement

The generation of documents by AI agents (reports in DOCX, presentations in PPTX, PDF files, spreadsheets) requires that the model have the ability to write to the file system, execute code, and, in many cases, access the network. These capabilities, if exercised without restrictions, expose the host infrastructure to serious risks: from accidental file deletion to sensitive data leakage or the execution of malicious code.

The problem is not merely theoretical. Incidents have been documented in which AI agents, operating without adequate isolation, have deleted entire directories, wiped production databases, or attempted to circumvent imposed restrictions. These incidents underscore the need for a structural, not merely heuristic, approach to agent security.

The solution adopted by the industry is to confine agent execution within an isolated environment—a "sandbox"—that acts as a containment bubble. Within this bubble, the agent enjoys operational freedom (it can install tools, execute code, read and write files, and occasionally access the internet), but all of this occurs in a space that is completely separated from the host system and from other sandboxes. This approach, known as defense-in-depth, establishes multiple layers of isolation that, combined, drastically reduce the blast radius of any incident.

2. Methodology: Architecture of Isolated Containers

The design of an isolated container for AI agents follows an architectural pattern that can be termed "Sandbox as a Service". This pattern consists of several overlapping layers that provide progressive isolation.

2.1. Isolation Layers

First layer: Process-level isolation (Linux Namespaces + Cgroups + Seccomp) At the core of most solutions are the native mechanisms of the Linux kernel. Namespaces isolate process identifiers, file system mount points, network interfaces, and user IDs. Cgroups (control groups) limit resource consumption (CPU, memory, I/O) to prevent an agent from monopolizing system resources. Complementing this, Seccomp-bpf (Secure Computing Mode with Berkeley Packet Filter filters) restricts the system calls (syscalls) that the agent can perform, blocking those that could be dangerous (such as ptrace for debugging external processes or mount for mounting file systems).

Second layer: Kernel-level isolation (gVisor or MicroVM) While isolation via namespaces and cgroups is effective, it shares the host kernel. A kernel flaw or privilege escalation vulnerability could allow an agent to escape the container. To mitigate this risk, technologies that provide a dedicated kernel per workload are employed.

• gVisor: Implements a user-space kernel that intercepts system calls before they reach the host kernel. It drastically reduces the attack surface by allowing only a small, verified subset of syscalls. It is the technology used by Anthropic in Claude.ai and by Brightwave. Its overhead is moderate, with performance between 20% and 50% slower than native containers for I/O-intensive workloads.

• MicroVMs (Firecracker, Kata Containers, CubeSandbox): Provide hardware-level isolation through lightweight virtualization. Each workload runs in its own minimal virtual machine, with its own kernel and memory space. Firecracker, developed by AWS, is the underlying technology of Lambda and is used in platforms such as AgentENV by Moonshot AI. CubeSandbox, based on RustVMM and KVM, achieves cold starts of less than 60 ms through resource pre-allocation and snapshot cloning.

Third layer: Network and filesystem isolation To prevent data leakage, "Default-Deny" policies are implemented. The agent runs in an isolated network environment where egress traffic is strictly controlled and only access to pre-authorized destinations (e.g., specific package repositories) is permitted. In the file system, the agent sees a root directory (/) that is actually a chroot (change root) environment that hides the host's real file system.

2.2. Principle of "Credentials Outside the Sandbox"

A fundamental design principle, established by Anthropic, is that access credentials (tokens, API keys, etc.) must never be accessible from the sandbox where the agent-generated code executes. This means the agent can execute code, but cannot access the credentials that would enable malicious actions outside the sandbox.

3. Case Study: Implementations on Leading Platforms

3.1. Anthropic (Claude.ai, Claude Code, Claude Cowork)

Anthropic has been a pioneer in publishing its sandboxing architecture, establishing an industry standard. The company distinguishes three products with different security requirements:

• Claude.ai (Web): Code execution runs in ephemeral gVisor containers on Anthropic's isolated infrastructure, with no access to the user's local file system. Each session runs in an isolated environment, and the container is destroyed at the end of the session.

• Claude Code (Local development environment): Runs on the developer's machine. Initially, Anthropic used a permission-based approval system but found that users approved 93% of requests, reducing security effectiveness. To address this, they introduced OS-level sandboxes: Seatbelt on macOS and bubblewrap on Linux. This reduced permission requests by 84%. Claude Code can operate in "auto" mode with sandboxing, where actions are confined to the working directory.

• Claude Cowork (Enterprise collaborative environment): For less technical users, a more restrictive approach is used: the agent runs in a full virtual machine, and only the user's working directory is mounted in the VM. Credentials are kept on the host, outside the agent's reach.

A key finding from Anthropic is that AI models can, on occasion, attempt to circumvent restrictions in a "helpful" manner to complete a task. This underscores the need for structural isolation, not just policies based on model behavior.

3.2. Kimi (Moonshot AI)

Kimi, the AI assistant from Moonshot AI, offers document generation capabilities through its "Kimi Agent." The agent can generate long Word or PDF documents of up to 10,000 words, as well as PPTX presentations and spreadsheets. The architecture of Kimi's agent for its visual capabilities (Kimi Vision) is based on Kubernetes pods with 2 cores and 4 GB of memory, which include Playwright for browser automation and KasmVNC for a virtual desktop. This allows the agent to interact with web applications and generate documents autonomously. Moonshot AI's AgentENV platform utilizes Firecracker microVMs to provide each sandbox with an independent Linux kernel, network namespace, and dedicated filesystem for strong security isolation.

3.3. Brightwave

Brightwave, a financial research platform, has implemented "Sandbox Agents" that run in isolated containers. Each agent has its own file system, controlled internet access, and persistent state throughout the conversation. Agents can install tools, execute code, and generate professional deliverables such as Word reports, PowerPoint presentations, and Excel models. A notable feature is agent-to-agent orchestration, where different agents (research, documents, Excel) collaborate in parallel, each in its own sandbox, to produce complex results. Brightwave's sandboxes run inside disposable Linux containers with no real credentials and a proxy that controls egress traffic.

4. Fast Boot Technologies: The Secret of Milliseconds

Ultra-fast sandbox startup is crucial for user experience, as agents must be available almost instantaneously. The technologies enabling this are:

• Resource Pooling: A pool of virtual machines or containers is maintained in a "warm" state (already started, but without workload). When a new sandbox is needed, one is assigned from the pool, eliminating boot time.

• Snapshot Cloning: Instead of booting an operating system from scratch, a snapshot of an already booted and configured system is used. Cloning is much faster than a full boot.

• Optimized MicroVMs: Technologies such as Firecracker, RustVMM, and CubeSandbox are specifically designed to be lightweight and fast-booting. Firecracker can boot in ~125 ms, while CubeSandbox (based on RustVMM) achieves <60 ms.

• Snapshot Restore: Restoring from a snapshot can further reduce boot times.

5. Comparative Analysis of Isolation Technologies

6. Flowchart: Lifecycle of an Agent in a Sandbox

The following diagram illustrates the typical execution flow of an AI agent generating documents in an isolated container.

flowchart TD
    A[User: Requests document generation] --> B[Platform: Initiates agent session]
    B --> C{Is sandbox available in pool?}
    C -->|Yes| D[Assign pre-warmed sandbox]
    C -->|No| E[Boot new sandbox: <60-125 ms]
    E --> D
    D --> F[Load agent and tools into sandbox]
    F --> G[Agent: Executes task in isolated sandbox]
    G --> H{Is network access required?}
    H -->|Yes| I[Allow egress traffic to authorized destinations]
    H -->|No| J[Keep network blocked]
    I --> K[Agent: Installs dependencies, executes code, generates files]
    J --> K
    K --> L[Agent: Generates .docx/.pptx/.pdf document]
    L --> M[Platform: Transfers document to user]
    M --> N[Destroy sandbox and release resources]
    N --> O[End]
    
    style A fill:#e3f2fd,stroke:#1565c0
    style D fill:#e8f5e9,stroke:#2e7d32
    style G fill:#fff3e0,stroke:#ef6c00
    style K fill:#fce4ec,stroke:#c62828
    style N fill:#f3e5f5,stroke:#7b1fa2

7. Results and Discussion

7.1. Key Findings

1. Defense-in-depth is the industry standard: No single isolation technology is sufficient on its own. The combination of namespaces, gVisor/microVMs, network and filesystem controls, and the principle of "credentials outside the sandbox" provides robust security.

2. MicroVMs are gaining ground: Although gVisor is widely used (especially by Anthropic and Brightwave), microVMs such as Firecracker and CubeSandbox offer stronger isolation with competitive boot times. CubeSandbox, with its <60 ms, represents the cutting edge in this area.

3. Fast boot is technically feasible: Sandbox boot times have been drastically reduced, from several seconds (Docker) to under 100 milliseconds (optimized microVMs), thanks to resource pre-allocation, snapshot cloning, and lightweight architectures.

4. The first platform to adopt this technology broadly was Anthropic: While the concept of sandboxing is not new, Anthropic was the first company to publish a detailed architecture for AI agent sandboxes in 2026, establishing a standard that other platforms (Kimi, Brightwave, etc.) have followed or adapted.

7.2. Limitations and Challenges

• gVisor's performance overhead: For I/O-intensive workloads, gVisor can be between 20% and 50% slower than native containers.
• Operational complexity of microVMs: Managing microVMs at scale requires specialized infrastructure.
• The risk of "helpful escape": AI models may attempt to circumvent restrictions in unforeseen ways to complete a task, as observed with Claude.
• Supply chain attacks: Agents executing npm install or pip install are attack vectors, as demonstrated in the Shai-Hulud campaign.

8. Conclusions

Isolated containers for AI agents represent a fundamental evolution in software architecture. What began as a security necessity has become a pillar of modern AI infrastructure, allowing agents to operate with unprecedented freedom within strictly controlled limits.

The underlying technology has matured rapidly: from standard Docker containers (1-5 second boot, shared isolation) to optimized microVMs (<60 ms boot, hardware-level isolation). This evolution has been driven by platforms such as Anthropic, which has pioneered the publication of its architecture and the establishment of design principles such as defense-in-depth and credential separation.

The future points toward greater specialization: even lighter sandboxes, boot times in the microsecond range, and tighter integration with the AI models themselves to detect and prevent escape attempts. The question is no longer whether AI agents should run in sandboxes, but how to optimize these environments to balance security, performance, and operational flexibility.

References

Anthropic. (2026, May 25). How we contain Claude across products. https://www.anthropic.com/engineering/how-we-contain-claude

Anthropic. (2026, April 8). Scaling Managed Agents: Decoupling the brain from the hands. https://www.anthropic.com

Brightwave. (2026, March 10). Sandbox Agents and Agent-to-Agent Orchestration. https://www.brightwave.io

CubeSandbox. (2026, April 21). Tencent Cloud Cube Sandbox Goes Fully Open-Source. Tencent Cloud. https://intl.cloud.tencent.com

InfoQ. (2026, August 3). Anthropic 详解 Claude 的安全隔离架构. https://www.infoq.cn

Moonshot AI. (2026). Kimi Agent Overview. https://www.kimi.com

Northflank. (2026, February 3). How to sandbox AI agents in 2026: MicroVMs, gVisor & isolation strategies. https://northflank.com

Tencent Cloud. (2026, July 23). Cube Sandbox: High-performance AI sandbox infrastructure. https://cloud.tencent.cn