Stage 7 · Lesson 4 of 5
Sandboxing and prompt injection
is text hidden in content the agent reads, a web page, an issue, a README or a package's docs, that tries to make it do something you did not ask, such as printing secrets or pushing code. Agents cannot reliably tell your instructions from text they read, so limit what a successful injection could reach.
runs commands with restricted file and network access. Claude Code has /sandbox, and bypassPermissions belongs only in an isolated container or VM. Cursor's Auto-review sandboxes commands where it can, with network blocked by default.
The has /sandbox enable and cloud sessions, both in preview. Review any action that touches secrets, the network or Git remotes.
Common trappointing an agent with broad permissions at an untrusted or website.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with
- GuideFreeBuilding Effective Agents
Anthropic · Advanced
Anthropic's clear, free essay on how agents work and when simpler workflows are better
Keep handy
Also worth your time
Permission levels, auto-approval risks, sandboxing and the security baseline for agents
- OWASP Top 10 for LLM ApplicationsGo deeper
Prompt injection and excessive agency explained by the security community