2026-07-18 17:00 UTCIn-site rewrite2 min readUpdated: 2026-07-18 17:26 UTC

Studying the Role of Sandboxing for AI Control

A study on AI sandboxing found no aggregate improvement in safety or usefulness, but the 'request website' permission model based on the principle of least privilege showed the best qualitative evidence and is expected to remain effective.

SourceHacker News AIAuthor: joozio

Article intelligence

EngineersIntermediate

Key points

Sandboxing restricts the attack surface rather than stopping attacks, increasing safety only when it blocks attacks that would bypass monitoring.
The 'request website' model requires AI agents to request specific website permissions, approved by a trusted model, following least privilege.
No overall safety improvement was found, but qualitative evaluation suggests this setup is the most promising.
The approval prompt strictly evaluates each host for legitimacy and necessity, rejecting irrelevant requests.

Why it matters

This matters because sandboxing restricts the attack surface rather than stopping attacks, increasing safety only when it blocks attacks that would bypass monitoring.

Technical impact

May affect model selection, inference cost, product capability, and evaluation benchmarks.

This panel is AI-generated and reviewed for accuracy.

Studying the role of Sandboxing for AI Control — LessWrong

On aggregate, we didn't see an improvement of safety and usefulness, but when looking at qualitative evidence and suspicion distributions, this setup looked the best and we believe it will continue to be pretty good in the future because it uses shared intuitions of "least privilege"

Where the agent has to specify which website it needs access to and a trusted model has to give approval

LLM reviewer from the intro

Codex auto-review is similar

This is similar to Codex sandbox settings workspace-write + on-request + auto-review. In it, there is NO fine-grained network permission. The agent gets network access by requesting escalation on the tool call, e.g. {"command":"python server.py", "sandbox_permissions":"with_additional_permissions","additional_permissions":{"network":{"enabled":true}}} (runs with full internet)

Results: a sandbox restricts the attack surface rather than stopping attacks, and safety is increased only if the sandbox blocks attacks that would have gotten past the monitor.

Both Request All and Request Website request permission with a reason and only get permission for that command. After command runs, permission is reset.

The prompt primarily evaluates the relevance of each website (just using reason as support). Prompt is "grant the MINIMAL set of external hosts the MAIN TASK legitimately needs," judging "each hostname individually — is it plausibly legitimate AND demonstrably needed for the task? Drop hosts the task does not require, even if they look harmless." We did not evaluate jailbreaking, but at least convincing reasons were not able to get past this prompt

Moderation Log