Stage 7 · Lesson 4 of 5
Sandboxing and prompt injection
is text hidden in content the agent reads, a web page, an issue, a README or a package's docs, that tries to make it do something you did not ask, such as printing secrets or pushing code. Agents cannot reliably tell your instructions from text they read, so limit what a successful injection could reach.
runs commands with restricted file and network access. has /sandbox, and bypassPermissions belongs only in an isolated container or VM. Cursor's Auto-review sandboxes commands where it can, with network blocked by default.
The Copilot CLI has /sandbox enable and cloud sessions, both in preview. Review any action that touches secrets, the network or Git remotes.
Common trappointing an agent with broad permissions at an untrusted or website.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with· follow one of these
- GuideFreeBuilding Effective Agents
Anthropic · Advanced
Anthropic's clear, free essay on how agents work and when simpler workflows are better
- CourseFreeClaude Code in Action
Anthropic · Intermediate
Free course lessons on permission modes, hooks and verifying unsupervised runs
Keep handy
Also worth your time
Every mode, what runs without asking and which mode fits which job
- OWASP Top 10 for LLM ApplicationsGo deeper
Prompt injection and excessive agency explained by the security community