Safety & Control

~8 min readUpdated: October 2026

AI Agent Sandbox Runtimes: Fork-to-Fleet Isolation

An agent that can run shell commands needs a sandbox, or it is just a remote code execution engine with a friendly prompt. Sandbox design is now a discipline of its own — from NVIDIA's **OpenShell** to the **fork-to-fleet** model of spinning up disposable, isolated agent environments at scale. This guide covers the layers of agent isolation and shows how the [zero-dependency runtime](/solutions/zero-dependency-agent-runtime) of Smoke Monkey Harness plus the fleet workspace of **Smoke Monkey Canvas** apply them.

Technical Review: Smoke Monkey Core Architecture Team

|Tested on Node.js 18+ & Bun|TypeScript 5.x

Quick Answer & Executive Definition

AI Agent Sandbox Runtimes: Fork-to-Fleet Isolation: An agent that can run shell commands needs a sandbox, or it is just a remote code execution engine with a friendly prompt. Sandbox design is now a discipline of its own — from NVIDIA's **OpenShell** to the **fork-to-fleet** model of spinning up disposable, isolated agent environments at scale. This guide covers the layers of agent isolation and shows how the [zero-dependency runtime](/solutions/zero-dependency-agent-runtime) of Smoke Monkey Harness plus the fleet workspace of **Smoke Monkey Canvas** apply them. Designed as a zero-dependency, open-source TypeScript architecture under the MIT License with native Model Context Protocol (MCP) support and deterministic phase state machines.

Key Architectural Takeaways

Isolation has layers: process, filesystem, network, and credentials — an agent needs all four.
Fork-to-fleet means every task starts from a clean, disposable environment instead of a shared machine.
Smoke Monkey Harness is a zero-dependency runtime that runs one agent safely; permission gates sit at every side effect.
Smoke Monkey Canvas scales that isolation to a fleet with per-agent workspaces and 300+ MCP tools.

Quick Implementation Examplesandbox-agent.ts

sandbox-agent.tstypescript

1import { createAgent } from 'smoke-monkey-harness';
2
3// One agent, one isolated workspace, every side effect gated
4const agent = createAgent({
5  provider: 'anthropic',
6  model: 'claude-sonnet-5',
7  workspacePath: '/sandbox/task-7f3a',
8  permissions: {
9    read_file: 'allow',
10    write_file: 'ask',     // pause before touching the workspace
11    run_command: 'ask',    // pause before spawning a process
12    network: 'deny',       // no egress unless explicitly granted
13  },
14});
15
16await agent.run('Install deps in the sandbox and report the build status');

Video Guides

Watch: Related Video Guides

Anthropic Just Built an Agentic OS — Open Source Harness Breakdown

Smoke Monkey

From fork() to Fleet: Designing an Agent Sandbox Cloud

AI Engineer

Why Agents Need Sandboxes, Not Just Prompts

A coding agent is, by design, a program that reads your files and runs commands. That is powerful and it is exactly a remote code execution engine if left unbounded. Sandboxing is how you keep that power without handing an LLM your credentials and your production filesystem. The 2026 conversation — NVIDIA's OpenShell, the fork-to-fleet pattern of ephemeral agent environments — reflects a simple truth: the safer default is a disposable, isolated box per task. Smoke Monkey Harness ships that discipline as a zero-dependency runtime, and Smoke Monkey Canvas scales it to a fleet.

The Four Layers of Agent Isolation

Real isolation is layered. Process: the agent runs in its own process tree that can be killed. Filesystem: it sees only a scoped workspace, not your home directory. Network: egress is denied by default so it cannot exfiltrate or phone home. Credentials: it holds short-lived, task-scoped tokens, not long-lived keys. Miss any layer and the others weaken. Smoke Monkey exposes filesystem and network as first-class permission scopes so an agent can be useful without being dangerous. Smoke Monkey Canvas shows each isolated agent and its requested permissions before you approve.

isolation.tstypescript

1import { createAgent } from 'smoke-monkey-harness';
2
3// Layer isolation: scoped workspace, deny-by-default network, gated shell
4const agent = createAgent({
5  provider: 'ollama',
6  model: 'qwen3:8b',
7  workspacePath: '/sandbox/run-42',     // filesystem boundary
8  permissions: {
9    read_file: 'allow',
10    write_file: 'ask',
11    run_command: 'ask',
12    network: 'deny',                   // network boundary
13  },
14  maxIterations: 30,                   // process-level runaway bound
15});

Fork-to-Fleet: Disposable Workspaces at Scale

Running one sandbox is easy; running hundreds is an architecture. Fork-to-fleet treats each task like a fork(): clone a clean base image, run the agent inside it, then throw the environment away. Nothing persists between tasks, so a poisoned workspace cannot infect the next run. In Smoke Monkey this maps to one agent per workspacePath; spin up as many as you need, each with the same permission gate and the same auditing. Combine it with the state machine's deterministic phases and you get reproducible, disposable agent runs. On Smoke Monkey Canvas you can spawn and tear down whole fleets of these boxes visually.

fork-fleet.tstypescript

1import { createAgent } from 'smoke-monkey-harness';
2
3// Each task forks into its own disposable sandbox
4async function runInSandbox(id: string, instruction: string) {
5  const agent = createAgent({
6    provider: 'anthropic',
7    model: 'claude-sonnet-5',
8    workspacePath: `/sandbox/${id}`,
9    permissions: { read_file: 'allow', write_file: 'ask', run_command: 'ask', network: 'deny' },
10  });
11  try {
12    return await agent.run(instruction);
13  } finally {
14    await disposeWorkspace(id);   // throw the box away
15  }
16}
17
18await Promise.all(tasks.map((t) => runInSandbox(t.id, t.instruction)));

A Fleet You Can See and Stop on the Canvas

A fleet of sandboxes is only safe if you can observe and kill it. Smoke Monkey Canvas (npx @smoke-monkey/canvas start) is the visual spatial multi-agent OS for exactly this: every agent is a card in its own workspace, with live status and streaming tool calls. When one agent requests a gated run_command, the approval prompt appears inline — approve it, or terminate the whole sandbox from the board. With 300+ MCP tools attached per fleet, Canvas becomes the control plane that makes agent security sandboxing and human-in-the-loop gating operational rather than aspirational. That control plane is only possible because Smoke Monkey Harness exposes every sandbox action as an auditable event.

Google Search Questions & Answers

Frequently Asked Questions

Q:What is an AI agent sandbox runtime?

It is the layer that lets an agent read files and run commands inside a bounded environment — scoped filesystem, denied network, short-lived credentials, and a killable process — so autonomy does not become unchecked access.

Q:What does fork-to-fleet mean for agents?

It means treating each task like a fork: clone a clean base environment, run the agent inside it, then dispose of it. Nothing persists between tasks, so contamination cannot spread across a fleet.

Q:Does Smoke Monkey Harness require containers to sandbox agents?

No. The harness ships a zero-dependency runtime with filesystem, network, and command permission gates. You can add containers or microVMs as an outer layer, but the safety model works out of the box.

Q:How do I stop a runaway agent in a fleet?

In Smoke Monkey Canvas each agent runs in its own workspace and appears as a card you can pause, inspect, or terminate. Bounded `maxIterations` in the harness prevents infinite loops in the first place.

Related Alternatives & Comparisons

vs Cognition Devin

Open Source Devin Alternative: Build Autonomous Software Engineers in TypeScript

Compare

vs Anthropic Claude Code

MCP Server Security Best Practices: Hardening Model Context Protocol Agents in 2026

Read Guide

Open Source

Open Source Coding Agent Harness: Build a Forkable, Local AI Engineering Runtime