Analysis · curated 10 Aug 2026
AI Sandbox Requirements for Code Interpreter Agents
First reported sandboxreview.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Code-interpreter and tool-using agents expose host filesystems, daemons, and package registries to attacker-controlled instructions, and this analysis lays out why intuitive denylist and allowlist defenses fail against injection, malicious tools, and sandbox-escape techniques.
Sandbox Review's analysis surveys the attack surface of code-interpreter AI agents, covering prompt injection into processed content, malicious MCP tools that inherit agent permissions, the late-2025 npm supply-chain campaign (including the Cline VS Code extension compromise), Pillar Security's mid-2026 'indirect sandbox escape' disclosures against Cursor, Codex, Gemini CLI and Antigravity, and the CIRCLE benchmark of 1,260 resource-exhaustion prompts. The piece synthesizes these existing findings to argue that sandboxes must enforce unconditional limits and treat any agent-writable input a host later trusts as part of the blast radius.