A sandbox without a network boundary is only half a sandbox
Compute isolation alone isn't enough. As AI agents gain code execution and file access, the network boundary becomes part of the security perimeter—and most sandboxes are missing it.
Why it matters
Vercel articulates a critical security architecture pattern for agent deployment: egress control (what untrusted code can reach) is as essential as compute isolation (what it can access locally). Recent research shows agents can exfiltrate data or receive commands through network paths even when the VM boundary holds, making network policy a baseline requirement, not an add-on.
The key facts
8 to knowAgent security requires dual boundaries: compute isolation + egress control
Prompt injection can instruct generated code to exfiltrate data without escaping the microVM if outbound traffic is unrestricted
DNS resolvers, proxies, and identity services are attack vectors if left unaccounted for in the security model
Vercel Sandbox implements host-level firewall with domain rules, CIDR policies, and dynamic credential injection (credentials never stored in sandbox)
Credentials injected at network boundary (TLS termination) rather than in environment variables prevents exfiltration and limits scope to configured destinations
Request forwarding enables custom policy layers (audit, authorization, supply-chain scanning) outside the sandbox
Full egress firewall now available on all Vercel Sandboxes (no paywall for security baseline)
Policy can be updated live without restarting the workload
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Running untrusted code safely requires more than separating it from the host. You also have to control what that code can reach. This matters more as AI agents gain the ability to read files, execute commands, install packages, and generate programs of their own. A microVM can prevent that code…