AI Agent Sandbox Architecture Uses OS-Level Isolation to Protect User Data from Adversarial Extraction

arXiv·high signal

Stanley, Verma, and Tsai propose an OS-level execution environment that sandboxes AI agent access to private user data (financial info, personal files) using containerized filesystem scopes, network allowlists, and environment whitelists. Unlike TEE-based approaches (cf. AgenTEE), this system operates at the OS layer with lower overhead while defending against indirect prompt injection and data exfiltration. The architecture includes a capability-based permission model where agents request specific data scopes rather than receiving blanket access.