AI agent sandbox execution: credential safety in isolated code execution environments

What sandbox isolation actually protects against

A well-configured sandbox provides layers of isolation — but each layer has a different threat model:

Pattern: inject vault key, not real key

Before spawning the sandbox, issue a vault key for the session and inject it as the API key the sandbox will use:

import os
import httpx

async def spawn_agent_sandbox(
    user_id: str,
    session_id: str,
    max_spend_usd: int = 50,
    max_lifetime_minutes: int = 30,
) -> dict:
    # Issue a vault key scoped to this sandbox session
    resp = httpx.post(
        "https://api.keybrake.com/v1/keys",
        headers={"Authorization": f"Bearer {os.environ['KEYBRAKE_TOKEN']}"},
        json={
            "label":             f"sandbox-{user_id}-{session_id}",
            "vendor":            "stripe",
            "daily_usd_cap":     max_spend_usd,
            "allowed_endpoints": ["/v1/payment_intents", "/v1/payment_intents/*"],
            "expires_in":        f"{max_lifetime_minutes}m",
        },
        timeout=3.0,
    )
    resp.raise_for_status()
    vault_key = resp.json()

    # Inject the vault token as STRIPE_SECRET_KEY
    # Set the Stripe base URL to the Keybrake proxy
    sandbox_env = {
        "STRIPE_SECRET_KEY":   vault_key["token"],      # vault key, not real key
        "STRIPE_API_BASE":     "https://proxy.keybrake.com/stripe",
        "KEYBRAKE_SESSION_ID": session_id,
    }

    # Spawn sandbox (E2B example — adapt for Modal, Fly, Docker, etc.)
    sandbox = await Sandbox.create(
        env_vars=sandbox_env,
        timeout=max_lifetime_minutes * 60,
    )

    return {
        "sandbox":      sandbox,
        "vault_key_id": vault_key["id"],
    }

After the sandbox terminates (or on error), revoke the vault key explicitly — don't rely solely on TTL expiration:

async def teardown_agent_sandbox(sandbox, vault_key_id: str) -> None:
    try:
        await sandbox.kill()
    finally:
        # Explicit revocation — TTL is the safety net, not the primary mechanism
        httpx.delete(
            f"https://api.keybrake.com/v1/keys/{vault_key_id}",
            headers={"Authorization": f"Bearer {os.environ['KEYBRAKE_TOKEN']}"},
            timeout=3.0,
        )

Configuring the sandbox's Stripe client to use the proxy

Most Stripe SDKs support overriding the base URL via an environment variable or constructor argument. In Python:

# Inside the sandbox — this is the agent-generated or agent-executed code
import stripe
import os

# stripe-python uses STRIPE_API_BASE if set
# Or configure explicitly:
stripe.api_base = os.getenv("STRIPE_API_BASE", "https://proxy.keybrake.com/stripe")
stripe.api_key  = os.environ["STRIPE_SECRET_KEY"]  # vault key token

# All stripe calls now go to proxy.keybrake.com — enforced at the proxy level
intent = stripe.PaymentIntent.create(amount=5000, currency="usd")

For Node.js inside the sandbox:

const Stripe = require('stripe');

// Override base URL to Keybrake proxy
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY, {
    host:     'proxy.keybrake.com',
    protocol: 'https',
    basePath: '/stripe',
});

const intent = await stripe.paymentIntents.create({
    amount: 5000,
    currency: 'usd',
});

Sandbox execution platforms and vault key integration

Defense-in-depth: vault key is one layer

Vault keys limit what the sandbox's API key can do. They don't replace sandbox-level network policies. The recommended defense-in-depth stack for agent sandbox execution:

1. Network egress policy — use network namespaces or egress rules to restrict outbound traffic to only the endpoints the agent needs (proxy.keybrake.com, your own APIs, approved data sources). Block all other outbound connections at the network layer.
2. Vault key endpoint allowlist — even if network egress is restricted to proxy.keybrake.com, the allowlist ensures the agent can only call the Stripe endpoints it's supposed to call, not admin or data deletion endpoints.
3. Vault key spend cap — the daily cap stops runaway loops that generate valid charges. Network policies don't know about Stripe spend.
4. Vault key TTL — even if a key leaks to logs or the agent's output, it expires when the sandbox should have terminated.
5. OS sandbox isolation — gVisor/Firecracker/seccomp prevents the agent from escaping to the host, reading other processes' memory, or making privileged syscalls.

Get early access

Related questions

Further reading

• AI agent vendor isolation — blast radius reduction via credential separation, endpoint allowlists, and spend caps — the conceptual foundation for sandbox credential patterns.
• AI agent API key lifecycle — issuance, enforcement, expiration, and revocation phases — matching each phase to the sandbox lifecycle.
• AI agent circuit breaker — spend-aware circuit breakers for the orchestrator layer, complementing vault key enforcement inside the sandbox.
• Multi-tenant isolation — per-tenant vault key issuance patterns for SaaS platforms where each user runs their own sandbox.
• AI agent compliance — audit trail and least-privilege requirements for sandboxed AI agent execution in regulated environments.