AI Coding Agent Sandboxes Compared: Docker, E2B, Cloud

What Docker, Claude Code, E2B and cloud sessions contain when a coding agent's prompts fail

Published 12 October 2026 Updated 12 October 2026

AI coding agent sandboxes compared against this year's real escapes all answer one question: when the prompt fails, what still holds? You have handed a coding agent a shell on the laptop that holds your keys, and the options in front of you (Claude Code's built-in sandbox, Docker Sandboxes, a Firecracker microVM, a managed cloud session) are not equally strong walls. What follows walks the same ground as the video: what each boundary covers, what it costs, what it misses, and why 2026's escapes worked with every wall still standing.

Your keys, one shell away

This year, Pillar Security found 7 sandbox escapes in which the agent never left its sandbox at all. That is the uncomfortable starting point for anyone running an agent on a machine with credentials on it.

The pattern is not one bad product. In 2026, prompt injection chained with sandbox or permission bypasses hit Snowflake's Cortex Code, Cursor, OpenAI Codex, Gemini CLI and Google Antigravity, a pattern across vendors. Even Anthropic's own Claude Code documentation states that isolation reduces the impact of a breach, but it does not eliminate risk.

One thing no sandbox changes: the prompts and files your agent reads still go to the model provider, sandbox or not. So the question is which wall to trust, not whether to isolate. Start with the wall you may already have switched on, and check whether it covers what you assume it does.

What Claude Code's built-in sandbox covers

Claude Code's sandboxed Bash tool uses the operating system's own locks: Seatbelt on macOS, bubblewrap on Linux and WSL2. It fences only shell commands: Bash, PowerShell and the Monitor tool.

Read, Edit, WebFetch, MCP servers and hooks run outside that boundary by default. Picture an MCP server that quietly reads your home folder: the sandbox never sees it. The fence covers the door you watch, not the side windows.

Anthropic's answer is an open-source package called sandbox-runtime, published on GitHub under the anthropics account and carrying 5.5k GitHub stars as of October 2026. It wraps the whole Claude Code process in the same Seatbelt or bubblewrap isolation, so MCP servers and hooks are fenced too. The package is free; the intelligence is not. Your prompts still go to Anthropic or your configured provider, and the material does not list that cost. The catch is stated plainly by Anthropic: it is a beta research preview, and Windows support is still alpha.

An OS sandbox is a fence on a shared machine. The next step up gives the agent its own kernel.

Docker Sandboxes and the shared kernel

Is a Docker container already a sandbox? An ordinary container shares your host's kernel, so one kernel bug and the wall is gone. On January 30, 2026, Docker shipped Docker Sandboxes, which put agents including Claude Code, Codex CLI, Copilot CLI, Gemini CLI and Kiro behind a microVM, a hypervisor boundary instead of a shared one.

Docker's own marketing claim is that it is the only sandboxing product that lets an agent build and run containers from inside, without the sandbox touching your host's Docker daemon. That matters if your agent's job is building images. Developer Matt Pocock, quoted on Docker's blog, says Docker Sandboxes have the best developer experience of any local AI coding sandbox he has tried. That is his opinion, published by the vendor, not a measurement.

The catch: the launch covers macOS and Windows, and the material does not name Linux. It also lists no price and no hardware requirements. Use it instead of Claude Code's built-in sandbox when your agent needs Docker itself. Do not count on it for a Linux workstation, because the launch named only macOS and Windows.

MicroVMs: the thickest wall, and its bill

A full VM is the strongest wall in this comparison. E2B's enterprise page states that each sandbox runs as a Firecracker microVM with its own guest kernel per session, on KVM, which means a kernel exploit inside the sandbox still needs a second escape, through the hypervisor, to reach the host. Cognition's Devin works on the same principle: a fresh, dedicated Linux VM in the cloud for every task, so a destructive command only wrecks a disposable machine.

That strength comes with a bill. E2B's free tier caps sessions at 1 hour. Its Pro plan is $150 a month plus per-second compute, and stretches sessions to 24 hours while raising concurrency from 20 to 100 sandboxes. That is the price of a kernel per task, before you pay anything for the model.

Thinner options exist. Kata Containers gives each workload its own lightweight VM with a dedicated guest kernel enforced by KVM. gVisor instead intercepts system calls in user space, with no hardware-level isolation, and deploys roughly twice as fast. Speed or a hardware wall: that is the trade.

Cloud sessions and the missing token

What a remote environment gives you that a local VM does not is distance from your secrets. Claude Code's cloud sessions run in an Anthropic-managed virtual machine behind a network proxy that enforces a default domain allowlist, and a separate proxy keeps your GitHub token outside the sandbox, issuing only scoped credentials inside it. An agent cannot leak a token it never held.

OpenAI's Codex cloud mode closes the network instead: every task boots a fresh container with networking disabled, preloaded with your repository. OpenAI reports that caching those containers rather than rebuilding them cut median task completion time by 90%. That is OpenAI's own figure, not an independent measurement.

The catch with both: your code runs on someone else's machine, and the material lists pricing for neither. Use the cloud when you want the agent far from your keys. Do not use it for code that is not allowed to leave your network.

How the 2026 escapes worked

Start with Snowflake. Security firm PromptArmor disclosed CVE-2026-6442 in March 2026: a GitHub README carrying hidden instructions talked the Cortex Code agent into bypassing its own sandbox-disable flag and a shell allowlist, and it reached the user's cached Snowflake credentials. Snowflake shipped a fix in Cortex Code CLI 1.0.25 on February 28, 2026. The prompt never broke a wall; it talked the agent past its own settings.

Then Pillar Security, on July 20, 2026, published 7 repeatable escape vectors across Cursor, OpenAI Codex, Gemini CLI and Antigravity. Every one followed a single pattern: the agent stays inside its sandbox, writes a file, and a trusted tool outside the sandbox later executes or loads it. Picture your agent editing a config file that your editor loads on its next start: the sandbox did its job, and you still lost.

Vendors responded unevenly. Cursor patched the flaw as CVE-2026-48124 in version 3.0.0. OpenAI fixed a related Codex CLI git-allowlist bypass in version 0.95.0 and paid a bug bounty. Google downgraded its two Antigravity reports as low priority.

What the wall can't see

A wall decides what the agent can touch. It does not see what the agent leaves behind for something else to touch. That blind spot is why the open-source tool Rashomon keeps an independent, parallel record of a Claude Code agent's tool calls, subagent activity and failed commands, because, in its README's words, your coding agent's final diff does not tell the whole story.

A June 2026 talk at AI Native DevCon put a name on a real case of an agent damaging files outside its intended scope, borrowing the agent's own catchphrase: "You're absolutely right, it was your home directory!" Every boundary here shares that blind spot, from bubblewrap on your laptop to a Firecracker VM in the cloud. A thicker wall sees no more than a thin one.

AI Coding Agent Sandboxes Compared: Empty the box

What holds when the prompt fails is what you never put inside the box. Not the thickest wall, but an empty one: no long-lived secrets, a closed or allowlisted network, and nothing the agent writes trusted on the way out. Snowflake's agent reached credentials because they were in reach. Pillar's escapes worked because a trusted tool ran what the agent wrote. Claude Code's cloud proxy works because the token is never inside.

If you run an agent on your own code on your laptop, take Docker Sandboxes on macOS or Windows, or sandbox-runtime on Linux, and keep your keys out of its reach. If you point an agent at repositories you do not trust, run it remotely: Claude Code's cloud with its credential proxy, or Codex cloud with networking off. If you are building a product that runs untrusted agent code, pay for a microVM per session, as E2B provides. And whichever you pick, review what the agent wrote before any tool outside the box runs it.

The line to take to your team is short. A sandbox does not protect your secrets. Not handing them over does.

Sources