Sandboxes are solved. The handoff after them is not.

Claim

The isolation primitive is no longer the weak point. In 2026 every published escape wrote a file (hook config, interpreter, git config, task definition) that a trusted, unsandboxed component later executed. Meanwhile "agent primitives" such as scheduled runs and webhooks ship per vendor with no cross-vendor standard.

Evidence

• Anthropic (2026-05-25): claude.ai uses ephemeral gVisor containers; Claude Code uses Seatbelt or bubblewrap with network denied by default; Cowork a full VM. A malicious workspace file exfiltrated data via the allowlisted Files API; the fix was an authenticating proxy inside the VM forwarding only requests bearing the VM's own scoped token.
• Kubernetes SIG Apps Agent Sandbox CRDs reached v1.0.x (September to October 2026) over gVisor and Kata, with warm pools, TTL deletion and hibernation.
• E2B is Firecracker microVMs under Apache-2.0 and self-hostable; Daytona is Linux containers by default under 90 ms with a VM option (third-party claims that Daytona uses Firecracker contradict its docs); Modal uses gVisor.
• CSA note on Pillar Security's "Week of Sandbox Escapes" (2026-07-20): none of seven issues broke the sandbox; Cursor CVE-2026-48124 fixed in 3.0.0; Codex CLI allowlist bypass fixed in 0.95.0; Google and OpenAI declined to fix a shared Docker-socket finding.
• Primitives: Managed Agents scheduled deployments (cron with jitter, per-run budgets) and signed webhooks; OpenAI background: true plus Standard Webhooks with 72-hour retries; A2A push notifications; MCP subscriptions/listen. No standard for scheduled triggers or session handoff; an IETF BOF request (2026-05-17) proposes long-lived agent sessions over QUIC with no working group chartered.

Open questions

• Whether Managed Agents' self-hosted sandbox can run on a LAN host.

Sources

• https://www.anthropic.com/engineering/how-we-contain-claude — blog, Sun May 24
• https://kubernetes.io/blog/2026/03/20/running-agents-on-kubernetes-with-agent-sandbox — blog, Thu Mar 19
• https://e2b.dev/open-source — docs, Wed Oct 21
• https://www.daytona.io/docs/en/getting-started/ — docs, Wed Oct 21
• https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/07/CSA_research_note_ai_coding_agent_sandbox_escapes_20260722-csa-styled.pdf — paper, Tue Jul 21
• https://platform.claude.com/docs/en/managed-agents/scheduled-deployments — docs, Wed Oct 21
• https://developers.openai.com/api/docs/guides/webhooks — docs, Wed Oct 21
• https://datatracker.ietf.org/doc/bofreq-krishnan-agent-communication-protocols/00/ — spec, Sat May 16

AI-assisted research: gathered and summarised with AI from the sources above, each claim checked against them.