AG
Sandbox Security ArchitectureDEMO

Sandbox Security & Defense Architecture

Target sandbox security architecture and currently available runtime controls.

Environment: DEMO / SPECIFICATION MODE
Environment: DEMO / SPECIFICATION MODE (Milestone 1) • Runtime: Simulated Telemetry

Control Specification Status: Target gVisor microVM runtime defined • Real Container Isolation scheduled for Milestone 2

2 VERIFIED7 SPECIFIED1 SIMULATED1 PLANNED

Security Isolation Controls & Verification Evidence

ControlCategoryTechnical MechanismStatusVerification Assertion
Unprivileged User NamespacescontainerHost user namespace remapping with uid 10001 (student runner)SPECIFIEDArchitecture Specification: Unprivileged container namespaces (uid 10001) specified for production Docker/gVisor runner
Read-Only Root FilesystemcontainerDocker `--read-only` flag with memory-backed tmpfs for `/tmp` onlySPECIFIEDArchitecture Specification: Container rootfs mounted read-only with tmpfs scratch in Docker provider
gVisor Microkernel SandboxingcontainerIntercepts syscalls via runsc interceptor to prevent kernel exploitsSPECIFIEDArchitecture Specification: runsc syscall virtualization designed for isolated worker nodes
cgroups v2 Hard Memory Ceilingresources1024MB limit, `--memory-swap=1024m` (zero swap enabled)SPECIFIEDArchitecture Specification: 1024MB container memory cap specified via Docker cgroups v2
Process Fork-Bomb Protectionresources`--pids-limit=64` stops malicious subprocess spawning loopsSPECIFIEDArchitecture Specification: --pids-limit 64 specified for container daemon
Default Deny Egress Network QuarantinenetworkContainer runs with `--network none` unless explicit whitelisted mock APIs requestedSPECIFIEDArchitecture Specification: --network none bridge isolation for untrusted student code
Cloud Metadata Server Blackholenetworkiptables drop rule targeting `169.254.169.254/32` (AWS/GCP IMDS endpoint)SPECIFIEDArchitecture Specification: iptables IMDS blackholing configured for production VPC
Ephemeral Token Redaction & SanitizationsecretsRegex AST scanner scrubs AWS, OpenAI, Anthropic, and Gemini keys from stderr/stdoutVERIFIEDPASS: In-memory token scrubber strips API keys from execution traces and stdout
Synthetic Indirect Prompt Injection FixturesadversarialAdversarial SEC 10-K test fixtures containing embedded instruction overrides (PI-001 to PI-030)SIMULATEDEvaluator runner applies PI-017 test fixture during benchmark analysis
Differential Multi-Turn Jailbreak FuzzingadversarialAutomated PyRIT/Garak prompt mutation against student agent tool routersPLANNEDTargeted for Milestone 2 advanced fuzzing release
Subprocess Execution Timeout EnforcementresourcesStrict 10.0-second async execution deadline preventing infinite tool loopsVERIFIEDPASS: asyncio.wait_for terminates execution on timeout SLA breach

Sandbox Security Audit Events (Simulated Telemetry Log)

Simulated containment telemetry modeled on isolated student agent container runs.

TimestampContainer IDStudentThreat / AnomalyMitigation TakenSeverity
2026-09-22 10:14:28 UTCcnt-3f8c92eAisha KhanPROMPT_INJECT: Indirect prompt injection instruction detected in SEC 10-K RAG ingestion (PI-017)Execution recorded; Flagged for lecturer rubric moderation; Token isolatedWARNING
2026-09-22 09:42:15 UTCcnt-7a2b91cLiam ChenBUILD_FAIL: Container failed launch due to conflicting wheel dependencies (chromadb vs pydantic)Container shutdown; Student notified via build diagnostic reportINFO
2026-09-21 16:30:04 UTCcnt-4e99d10Marcus VanceRESOURCE_WARN: Recursive agent loop generated 14 repetitive web search requestsLoop throttled by evaluator SLA (60s limit); Flagged in cost telemetryWARNING
2026-09-21 14:12:33 UTCcnt-88f11a0David O'ConnorDROP_EGRESS: Unauthorized outbound socket connection to 169.254.169.254:80 (Cloud IMDS)Packet dropped by iptables bridge; Security audit loggedCRITICAL
2026-09-20 18:05:11 UTCcnt-11a92e1Elena RostovaSIGKILL: Process exceeded 1024MB memory ceiling during embedding indexationContainer terminated cleanly by cgroups v2; Host memory unaffectedCRITICAL