privilege-separated sandboxing

Traditional sandboxing mechanisms require application code refactoring, severely hindering deployment in legacy systems. This paper proposes Threadbox, a fine-grained, thread-level sandboxing framework that enables modular isolation and resource control for arbitrary functions without modifying application architecture. Its core innovation lies in lowering the sandbox boundary to the thread level, synergistically integrating runtime scheduling with OS-level resource isolation to deliver a lightweight, dynamic, and embeddable secure execution environment. Evaluation demonstrates that Threadbox effectively isolates sensitive operations with an average performance overhead of less than 8.2%. It significantly enhances sandbox flexibility, integrability, and practical applicability—advancing secure isolation toward modularity and runtime programmability.

This work addresses the security risks posed by AI agents frequently executing untrusted code on developer machines, where existing isolation mechanisms suffer from limitations in privilege requirements, performance overhead, and granularity of control. The authors propose a privilege-free, fine-grained process sandboxing architecture that compiles static security policies into kernel-enforced rules using Linux primitives such as seccomp and namespaces, while delegating dynamic decisions to a lightweight userspace supervisor. This approach enables rootless enforcement over filesystem, network, IPC, and system call access, supports time-of-check-to-time-of-use (TOCTOU)-safe validation and reversible file operations, and avoids dependencies on containers, cgroups, or images. Experimental results demonstrate a startup overhead of only ~5 ms, Redis performance matching bare-metal levels, and stage-based isolation of data, network, and untrusted content.

Rust’s memory safety relies on its ownership system, yet `unsafe` code can bypass these checks, introducing critical security vulnerabilities. Existing isolation approaches support only static, fixed-boundary sandboxing of `unsafe` modules, lacking flexibility for dynamic, fine-grained co-sandboxing of safe and unsafe code. This paper proposes a lightweight, syntax-aware dynamic isolation mechanism for Rust: leveraging zero-cost abstractions and fine-grained sandbox partitioning, it enables runtime-configurable cross-safety-domain policies; combined with optimized data transfer, it significantly reduces inter-sandbox call overhead. Evaluated on multiple real-world Rust applications, the mechanism effectively contains vulnerability propagation while incurring an average performance overhead of less than 8.2%. It thus achieves a practical balance among security assurance, usability, and backward compatibility.

This work addresses the vulnerability of tool-augmented large language models to prompt injection and sensitive data leakage during execution, a challenge inadequately mitigated by existing static analysis techniques that fail to capture dynamic behaviors. The paper presents the first lightweight framework integrating WebAssembly/WASI sandboxing with runtime provenance tracking to securely execute untrusted tools via the Model Context Protocol (MCP). It dynamically traces the flow of external inputs—such as environment variables, file contents, and HTTP payloads—to sensitive outputs, enabling auditable leakage detection through runtime analysis and substring matching. Case studies on three representative tools successfully identify input leakage and filesystem privilege violations. Experimental results demonstrate significant improvements over static string-signature methods, with microbenchmarks quantifying both false negative and false positive rates.

Why is seccomp sandboxing rarely adopted in practice? This study investigates the usability barriers hindering real-world seccomp deployment through an empirical study with seven experienced seccomp developers. Our mixed-methods approach integrates qualitative usability testing, task-based observation, semi-structured interviews, and comparative analysis of sandboxing policies. We systematically identify twelve recurring usability challenges, distill five canonical sandbox design patterns, and propose a developer-centered framework for evaluating sandboxing usability. Based on these findings, we derive eight actionable improvement strategies—enhancing tool comprehensibility, configuration efficiency, and error diagnosability. The work provides both methodological foundations and practical guidance for engineering robust, deployable system-level sandboxing solutions.

Current research on the security of execution environments for AI coding agents remains highly fragmented, lacking systematic integration and cross-disciplinary coordination. This work presents the first comprehensive survey of the field, analyzing 39 papers published between 2023 and 2026 and categorizing them into 17 thematic groups. Through CVE validation, cross-category comparison, and threat modeling, the study identifies critical disconnects among key areas such as isolation, access control, and time-of-check-to-time-of-use (TOCTOU) vulnerabilities, revealing five major research gaps. The analysis confirms four patched CVEs affecting production frameworks, quantifies the failure rate of existing mitigation strategies at 69%–98%, and uncovers that 17.1% of benign out-of-bound behaviors remain unaddressed by current mechanisms. Building on these findings, the paper proposes a unified research agenda to advance the field.

This work addresses the challenge that existing AI experimentation platforms struggle to simultaneously support rapid prototyping and governance requirements such as access control, tenant isolation, and process transparency. The authors propose and implement a governance-aware, multi-tenant AI sandbox platform featuring a layered architecture that decouples the user interface, control plane, and execution layer. The platform integrates approval workflows, audit logging, and configuration persistence mechanisms, and innovatively combines structured experimentation with cross-project reusable evaluation evidence generation, thereby establishing persistent linkages between governance decisions and experimental data. Deployed in an industry–academia collaboration setting, the platform demonstrates its effectiveness in enabling controlled collaboration, traceable experiments, and cross-project result comparison, offering a reusable reference architecture and practical insights for integrating governance into AI development environments.