Skip to main content

Sandbox isolation

Each AISafe AI agent runs inside an isolated sandbox: a constrained execution environment with no access to other customers' data, no persistent storage, and controlled network egress. Even if an agent misbehaves, it cannot cause harm outside its assigned task.

How sandboxes work​

AISafe spins up one or more sandboxes for the AI agents at the start of each assessment. Each sandbox:

  • Runs in an isolated environment: the agent's execution environment shares no filesystem or memory with other sandboxes or the host.
  • Has controlled network access: the sandbox uses a network allowlist. For pentests, it reaches your target URLs, additional allowed domains and, when available, AISafe’s pinned callback server for out-of-band tests.
  • Is ephemeral: the platform destroys the sandbox when the assessment completes (or times out). No state persists between assessments.

No data egress​

AISafe's sandbox network policy prevents data exfiltration:

  • Code audits: the sandbox processes your source code. It does not upload your code to any external service except the AI model provider for reasoning.
  • Pentests: target traffic stays within your target URL paths and additional allowed domains. When callback access is available, its traffic is captured and rate limited, and it connects only to AISafe’s pinned callback server on ports 80 and 443. The platform blocks other hosts.

Browser traffic uses the same egress policy as HTTP tools. The sandbox blocks direct browser connections, including connections from newly created browser contexts, so browser settings cannot bypass your configured scope. Agent code does not receive the credentials used to control the sandbox or permission to change its network policy.

If a target resets an HTTP/2 stream, the proxy uses HTTP/1.1 for later requests. It can immediately retry GET, HEAD and OPTIONS when their bodies are replayable. It does not automatically repeat other methods after that error, because the target may already have applied the request.

Token isolation​

AISafe uses short-lived installation access tokens to access your source code via a GitHub or GitLab integration:

  • Short-lived: tokens expire within a fixed window and do not touch disk.
  • Single-repository scope: each token covers one repository, which keeps the damage from any compromise as small as possible.
  • In-memory only: the scan holds tokens in memory for its duration, then discards them.

Even if a sandbox were compromised, the attacker would access a single repository for a limited time, with no ability to escalate to other repos or persist access.

What this means for you​

You can use AISafe to audit sensitive codebases and test production-adjacent applications, knowing that:

  • Your source code stays in an isolated environment, away from the internet
  • AI agents cannot reach unintended internal services during pentests
  • Access tokens expire within a short window and cover a narrow scope
  • No data persists after the assessment completes