A sandbox is a walled-off environment where an agent can execute code, install packages, and write files without touching anything outside it. The container gets its own filesystem and usually its own network rules. When the task ends, it is thrown away.
This is the main structural defence for agentic tools. A model that can run commands is useful precisely because it can change things, and the sandbox is what stops "change things" from meaning your home directory, your credentials, or your production database. Most desktop and cloud coding agents now run inside one by default.
Why it matters at your desk. The question worth asking any vendor is not whether they sandbox, but what the sandbox still reaches. Network access is the usual gap: an isolated filesystem with open outbound network can still send data anywhere, which is how agent incidents tend to escalate from embarrassing to serious. The Hugging Face agent security incident turned on exactly that distinction.
Mounted folders are the other one. When you point an agent at a directory, you have deliberately made a hole in the wall — everything in that folder is now in scope, including the files you forgot were there. For regulated work, scope the mount to the matter you are working on rather than the drive it lives on.
What to watch for: a sandbox contains the agent, not the consequences of what you approved. If the agent asks to push a commit, send an email, or call an API and you say yes, the isolation ends there. Pair it with guardrails and a human approval step on anything that leaves the box.