AI Security Atlas › All entries › Autonomous Agent & MCP Security

GuardrailFixes high risks

Hardened Execution Sandbox

Agent-generated code runs in ephemeral, network-restricted containers with no secrets, resource limits, and approval for elevated actions.

Impact

Contains code execution so a successful injection cannot reach the host, secrets, or internal network.

Why this severity

Guardrails take the highest severity of the risks they mitigate: Dynamic Code Execution (High), Prompt-to-Code Execution in Agents (High).

Method: OWASP Risk Rating Methodology

Related

Mitigates

• Dynamic Code Execution Vulnerability · High severity
• Prompt-to-Code Execution in Agents Threat · High severity

Remediation

1. Use a fresh container or microVM per run; destroy it afterward.
2. Mount no credentials; deny network egress unless allowlisted.
3. Allowlist packages and require approval for anything else.

How to verify

• Escape payloads (env dump, metadata service, socket open) fail inside the sandbox.
• Sandbox images are rebuilt and scanned on a schedule.

Pattern

await sandbox.run(code, { network: 'deny', mounts: [], cpu: 1, memoryMb: 512, timeoutMs: 10000 });

Framework mapping

OWASP Top 10 for Agentic Applications 2026

• ASI05:2026 Unexpected Code Execution

OWASP Top 10 for LLM Applications 2025

• LLM06:2025 Excessive Agency

MITRE ATLAS

• AML.M0032 Segmentation of AI Agent Components
• AML.M0029 Human In-the-Loop for AI Agent Actions

NIST AI RMF 1.0

• MEASURE 2.7 AI system security and resilience are evaluated and documented