How to Sandbox an Autonomous Coding Agent

Running a coding agent with your home directory mounted and an open network connection? It does not need a clever prompt to walk off with your cache. It needs a writable mount and a curl binary, and you handed it both.

The fix is not a better prompt wrapper. It is OS-level isolation, and it comes down to four changes you can make today.

What You Need

• An autonomous coding agent you already run with host filesystem mounts and outbound network access.

Tutorial

1. Run the agent sandbox in a disposable container with no default gateway. Raw outbound access is what let the agent reach your local cache in the first place.
2. Mount only the repository root, never your user directory. If the user directory is not mounted, the agent has no read access to your local cache at all.
3. Run verification against local mock fixtures. Keeping the checks local means the agent has something to test against without leaving the box.
4. If the agent needs dependencies, pull through an internal allowlist. The agent still gets its packages, but only the ones you have already approved.

Wrapping Up

That is the difference between an agent that can see your repo and one that can see your whole machine. Set the container up once, and the same harness that felt risky starts behaving like an ordinary build step.

The plumbing is the security control here, so pick the isolation options first and let the prompts sort themselves out later.