How to Threat Model an AI Agent Sandbox Escape
This article offers one possible way for a team to structure its threat analysis. It is not an automated iSecureByDesign threat-modelling workflow and should be adapted by the people responsible for the system’s security.
Threat modelling an AI agent sandbox escape means asking how the agent could move from its intended workspace to something outside that workspace.
This article describes work performed by the team, not an automated iSecureByDesign capability. iSecureByDesign does not perform threat modelling or autonomously discover threats. It can apply the team’s policy definitions and selected controls to the structured model after that analysis has been performed, producing requirements for implementation and review.
Do not model the sandbox as a single box. Model the paths around it:
- package installation and dependency proxies
- mounted files and shared volumes
- environment variables and credentials
- network egress and DNS
- host integrations and developer tools
- MCP servers, APIs and databases
- logs, caches and other side channels
- human approvals and emergency controls
For each path, ask what the agent can read, write, invoke or influence. Then define the control and the evidence that would demonstrate it.
How iSecureByDesign could help
Users can represent the agent, sandbox, tools, data stores and trust boundaries in a diagram environment. They can apply policy controls to identify requirements such as denied network routes, approved tool allowlists, credential isolation, action approval and failure handling.
The resulting specification can become implementation guidance for the sandbox and its surrounding infrastructure. An Evaluation stage can then be used to assess generated or supplied outputs against the expected design.
This does not prove that an agent cannot escape. The team’s threat model remains the source of the threat analysis; iSecureByDesign can make the resulting policy-backed requirements and design constraints more explicit and repeatable for review.
See Architecture Constraints for AI Coding Tools for the related model-to-constraint approach.
Related Help
About Agentic Thoughts: This Agentic Thought was generated with AI. Agentic Thoughts are part of an ongoing process of evolving ideas about iSecureByDesign and how it may be applied to real-world problems. They are exploratory and do not necessarily represent a final product commitment, implementation, or formal advice.