Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Sandbox egress control: half a sandbox without a network boundary
- Security
- AI
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On August 11, 2026, Brandon Tuttle argued that compute isolation alone is only half a sandbox for agent workloads. A microVM can keep untrusted code off the host, but without egress control that code can still exfiltrate data, probe internal services, or abuse credentials available inside the environment. Recent research shows a forgotten DNS path or fail-open allowlist can defeat containment without crossing the VM boundary.
Vercel Sandbox enforces the network boundary on the host outside the microVM: domain and CIDR policies, SNI inspection for TLS destinations, DNS filtered with the same rules, credential injection at the firewall so API keys never enter the sandbox, and optional request forwarding through your own proxy with a Vercel OIDC identity. Policies can open, narrow, and deny connectivity while a sandbox is running — for example allow a registry during setup, then deny-all before generated code runs.
Those Node-side secrets and sandbox boundaries matter for the same server and deploy path you meet in Chapter 5 and Chapter 1.
Read original: A sandbox without a network boundary is only half a sandbox — Vercel