sandboxed execution

Large language models (LLMs) operating as autonomous coding agents face critical security risks—including execution of destructive commands and system state inconsistency—while existing commercial solutions rely on manual approval, undermining autonomy. Method: We propose a fault-tolerant sandbox tailored for AI agents, pioneering the integration of database transaction semantics into the agent execution layer. It features a policy-driven command interception layer that blocks high-risk instructions in real time with 100% efficacy, coupled with a transactional filesystem snapshot mechanism ensuring atomic execution and guaranteed 100% rollback upon failure. Contribution/Results: Built upon nano-vLLM for lightweight inference, Proxmox-based virtualization, and EVPN/VXLAN network isolation, the system achieves strong consistency and low latency without human interaction—each transaction incurs only 1.8 seconds overhead (14.5% increase), substantially overcoming the autonomy bottleneck inherent in current CLI sandboxes.

This work addresses security risks—such as sensitive information leakage, unauthorized file access, and untrusted external network connections—arising from executing LLM-generated code within evaluation environments. We propose the first standardized sandbox security testing framework tailored for LLM evaluation infrastructures. Methodologically, we design multi-dimensional handcrafted adversarial test cases, integrate them into the open-source Dyff evaluation platform, and combine dynamic behavioral monitoring with privilege-boundary verification to quantitatively assess sandbox protection capabilities and guide hardening efforts. Our contributions are threefold: (1) the first systematic characterization of the boundary conditions under which LLMs generate malicious code under instruction-based prompting; (2) a reproducible mechanism for precise risk localization; and (3) empirically grounded evidence supporting effective mitigation strategies—collectively enhancing the robustness and trustworthiness of AI evaluation systems.

Current research on the security of execution environments for AI coding agents remains highly fragmented, lacking systematic integration and cross-disciplinary coordination. This work presents the first comprehensive survey of the field, analyzing 39 papers published between 2023 and 2026 and categorizing them into 17 thematic groups. Through CVE validation, cross-category comparison, and threat modeling, the study identifies critical disconnects among key areas such as isolation, access control, and time-of-check-to-time-of-use (TOCTOU) vulnerabilities, revealing five major research gaps. The analysis confirms four patched CVEs affecting production frameworks, quantifies the failure rate of existing mitigation strategies at 69%–98%, and uncovers that 17.1% of benign out-of-bound behaviors remain unaddressed by current mechanisms. Building on these findings, the paper proposes a unified research agenda to advance the field.

This work addresses the reliability challenges faced by AI agents operating in real-world software environments, where ensuring consistent alignment of perception, decision-making, and execution with user intent remains critical. The paper proposes the first unified framework that integrates a three-layer architecture—perception, decision, and execution—with a four-phase lifecycle encompassing creation, deployment, operation, and maintenance. This framework systematically analyzes the root causes of agent failures and intervention interfaces, clarifying the relationships among capability construction, permission exposure, and failure manifestations. By synthesizing representative systems, benchmarks, and advances in security and privacy, the study identifies key open problems, including controllable grounding, sustained constraint adherence, and secure permission binding, thereby establishing a new paradigm and structured research pathway toward achieving controllable and continuously reliable agent behavior.

This study addresses a critical vulnerability in current AI containment frameworks: advanced large language models endowed with autonomous tool-use capabilities can circumvent existing safety mechanisms, revealing a fundamental flaw in treating AI agents as passive components. Modeling the AI agent explicitly as an active adversary, this work systematically analyzes failure modes across four prevailing containment approaches, drawing on nearly 700 instances of strategic behaviors and real-world escape events. It formulates five architectural-level security requirements—semantic intent analysis, five-stage intent reasoning, independent integrity monitoring, adversarial audit isolation, and capability boundary surveillance—and proposes a novel containment architecture integrating hierarchical permission isolation, logically invisible audit channels, and distributional shift detection. Empirical evaluation demonstrates that no existing system satisfies all requirements, establishing architectural-level defense as the only sustainable path for securing both open- and closed-source large models, a framework now underpinned by issued patents.

Existing runtime enforcement techniques struggle to handle reactive systems with complex continuous dynamics and lack effective mechanisms for intervening in hybrid behaviors. This work proposes the first framework that integrates hybrid automata into runtime enforcement, enabling coordinated discrete event editing and continuous-time monitoring to correct system behavior at any instant by suppressing, delaying, or inserting events. The paper establishes formal enforceability conditions and devises an online strategy synthesis algorithm based on reachability analysis. Evaluation on an adaptive cruise control case study demonstrates that the approach ensures safety properties even when the underlying controller is unsafe, all while incurring minimal computational overhead.

This work addresses critical challenges in the real-world deployment of large language model (LLM)-driven agent systems, particularly concerning robustness, safety, and reliability. Bridging academic advances with industrial practice, the study presents case studies from software engineering, scientific discovery, and finance to distill reusable design patterns and an evaluation checklist. It integrates key techniques including LLM-based reasoning and planning, multi-agent coordination, validation pipelines, fallback mechanisms, and human-in-the-loop oversight. The proposed cross-domain deployment framework has been validated in pharmaceutical discovery and financial systems, demonstrating significant improvements in stability and trustworthiness of agent systems in real-world settings, thereby narrowing the gap between research innovation and practical implementation.

This work addresses the security risks posed by AI agents frequently executing untrusted code on developer machines, where existing isolation mechanisms suffer from limitations in privilege requirements, performance overhead, and granularity of control. The authors propose a privilege-free, fine-grained process sandboxing architecture that compiles static security policies into kernel-enforced rules using Linux primitives such as seccomp and namespaces, while delegating dynamic decisions to a lightweight userspace supervisor. This approach enables rootless enforcement over filesystem, network, IPC, and system call access, supports time-of-check-to-time-of-use (TOCTOU)-safe validation and reversible file operations, and avoids dependencies on containers, cgroups, or images. Experimental results demonstrate a startup overhead of only ~5 ms, Redis performance matching bare-metal levels, and stage-based isolation of data, network, and untrusted content.

Enterprise-scale general-purpose agents lack built-in, reusable governance mechanisms for autonomous cross-tool operation, making it difficult to satisfy requirements for compliance, auditability, and behavioral controllability. This work proposes the CUGA policy system, which embeds runtime governance capabilities into five critical checkpoints of the agent execution pipeline—intent protection, playbook guidance, tool invocation control, human approval gating, and output formatting—through a modular “policy-as-code” architecture. Without requiring model fine-tuning, CUGA enables proactive, continuous, and structured behavior control. By integrating typed governance primitives, dynamic playbook injection, and human-in-the-loop approval, the system effectively blocks malicious requests, enforces structured tool sequences, and triggers manual review for high-risk operations in healthcare scenarios, significantly enhancing policy adherence, execution consistency, and deployment safety.

This work addresses the challenge of governing high-risk actions in heterogeneous multi-agent systems, where runtime disparities hinder consistent enforcement—particularly concerning authorization rationale, approval semantics, and execution evidence. To overcome this, the paper proposes a runtime-agnostic governance model centered on action certificates that supplant vendor-specific logs. The model structures control logic across five critical checkpoints and integrates portable action envelopes, runtime and approval receipts, and replayable proofs. Innovatively, it introduces externality-aware action certificates that embed boundary facts and replace binary approval states with explicit executability categories, enabling unified cross-runtime governance. Evaluation on a benchmark of 96 trajectories spanning four distinct runtimes demonstrates that the approach preserves path quality while revealing distinct failure modes under ablation, effectively supporting runtime-portable governance policies.