Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives

A paper submitted to arXiv on 25 May 2026 introduces Sandlock, a lightweight Linux process sandbox for confining untrusted code run by AI agents, which adds roughly 5 ms of startup overhead and runs Redis at bare-metal throughput (within measurement noise). Sandlock compiles static, input-independent policy into kernel-enforced rules while a narrow supervisor handles runtime-dependent decisions, enforcing filesystem, network, IPC and syscall policies without root, cgroups, images or mandatory namespaces. The authors report dynamic network decisions, HTTP-level access control, TOCTOU-safe inspection of execve arguments, reversible filesystem effects and per-stage confinement via a pipeline operator, with code available at github.com/multikernel/sandlock.

Computer Science Cryptography and Security Submitted on 25 May 2026 Title:Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives View PDF https://arxiv.org/pdf/2605.26298 HTML experimental https://arxiv.org/html/2605.26298v1 Abstract:AI agents increasingly run untrusted code on developer machines: shell commands generated by language models, third-party scripts retrieved at runtime, and tool plugins of unknown provenance. Existing isolation mechanisms impose tradeoffs that fit this workload poorly: containers and microVMs add privilege, image-management, and startup costs, while ad-hoc process controls and wrappers e.g. chroot, ulimit provide weak guarantees and little syscall-level control. Sandlock is a lightweight Linux process sandbox organized around a simple split: static, input-independent policy is compiled into kernel-enforced rules, while a narrow supervisor handles runtime-dependent decisions and virtualized effects. This split lets Sandlock enforce filesystem, network, IPC, and syscall policies without root, cgroups, images, or mandatory namespaces. It also supports dynamic network decisions, HTTP-level access control, TOCTOU-safe inspection of execve arguments, and reversible filesystem effects. On our workstation, Sandlock adds roughly 5 ms of startup overhead and runs Redis at bare-metal throughput within measurement noise ; its pipeline operator further supports per-stage confinement for separating data, network, and untrusted-content capabilities. Sandlock is available at this https URL https://github.com/multikernel/sandlock Additional Features References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .