AI agent security: how sandboxing keeps agents safe

An AI agent that can run code, read files and send email is genuinely useful — and genuinely powerful. Security is what lets you hand off that power with confidence. Here are the principles that matter.

1. One sandbox per agent

Each agent should run in its own isolated environment — its own VM — with no shared state. That means no cross-tenant data leakage and a contained blast radius: if a task misbehaves, it can't reach anyone else's data or machine.

2. Vetted tools, not arbitrary access

An agent should reach for a reviewed set of tools, not raw, unrestricted system access. Curating what an agent can do is how you keep capability high and risk low. Higher-risk abilities (running shell, executing code) run as a restricted user, never as root.

3. Keep secrets off the agent

This one is subtle but critical: frontier-model API keys should never live on the machine the agent controls. On minion.sg, model keys stay on the platform and are attached at request time through a metering proxy — so the agent can think with a frontier model while the keys stay out of its reach.

4. Human-in-the-loop where it counts

Good agent design lets you require approval for sensitive actions — "draft the reply but don't send", "escalate refunds to me". You expand what you hand off as trust grows, on your terms.

The takeaway

Power without guardrails is a liability; sandboxing, vetted tools, key isolation and human checkpoints are the brakes. That's how managed agentic hosting lets a minion do real work safely. See how it works or hire your first agent.