# Build a secure computer for your agent

## Executive summary

As agents evolve beyond simple Q&A to writing and executing complex code (e.g., data analysis, software engineering), they require an isolated, persistent computing environment. The session details the architecture of LangSmith Sandboxes, a solution designed to provide production-ready, secure execution by giving each agent its own disposable computer. This system addresses critical challenges like untrusted model-generated code, container escape vulnerabilities, and scaling limitations inherent in traditional local or vanilla container setups.

## Key takeaways

- Production-Grade Isolation: Sandboxes utilize hardware virtualized microVMs for kernel-level isolation, ensuring that malicious code cannot escape the environment (preventing issues like container escapes). This level of separation is necessary because agents run untrusted, model-generated code.
- Scalability and Performance: The platform supports scaling from one to thousands of isolated sandboxes in parallel. Benchmarking shows a median spin-up time of approximately one second, making it suitable for high-volume, user-facing applications.
- Secure Credential Management: The O proxy acts as a man-in-the-middle proxy controlling all egress from the VM. This ensures that credentials never touch the runtime, significantly mitigating risks associated with data exfiltration or malicious network calls.
- State Persistence and Resilience: Sandboxes support persistent state across long-running, interruptible tasks. Users can snapshot and restore the entire environment (including file system and memory), allowing for rollbacks or forking to test multiple scenarios.

## Technical details

- Agent Execution Model: Agents require a full computing environment (file system, shell, installed packages) to perform tasks like running code tests or analyzing data. This capability is necessary because agents are no longer limited to predefined tools.
- Security Architecture: The use of microVMs provides hardware-level separation, which is superior to standard containers (like Docker) for running untrusted code because it prevents kernel exploits and ensures robust isolation boundaries.
- Networking Control: The O proxy controls all network egress, allowing users to white-list specific domains and preventing malicious communication or data exfiltration to unauthorized endpoints. This is cited as the most powerful security control.
- State Management: Sandboxes support persistent state, allowing processes to be paused and resumed (e.g., for long-running tasks). Features include snapshotting, which allows restoration from any point in the agent's lifecycle.

## Practical implications

- Build engineers can integrate sandboxed execution into CI/CD pipelines to safely run and test model-generated code (e.g., running a PR diff) without risking the core infrastructure.
- The platform enables building complex, multi-step agent workflows that require state persistence over extended periods, moving beyond simple API calls.
- By using microVMs and network controls, organizations can deploy agents in highly regulated environments where strict isolation is mandatory.

## Topics

Agent Engineering, Sandboxing, MicroVMs, Security Architecture, Scaling, Build Automation, LangSmith Sandboxes, OpenSuite

Source: https://www.youtube.com/watch?v=DHTnxP6oUIk