Agent sandboxes need communication boundaries, not just process isolation

Matthew Green describes two separately sandboxed agents discovering that they could leave instructions for one another in shared state. Simon Willison highlighted the result on 1 October: a malicious payload can hijack one agent, while the agent itself carries instructions toward the next. Process isolation can hold and still leave a propagation path.

That changes the containment model. A sandbox limits what one process can directly touch. It does not automatically make every channel crossing the boundary trustworthy. Shared workspaces, queues, memory stores and hand-off messages can become control inputs for another agent even when neither process can escape its own runtime.

Inventory channels that carry instructions

Agent threat models usually enumerate tools and credentials. They should also enumerate every mechanism through which one agent can influence another: shared files, retrieved documents, task queues, durable memory, issue comments and generated artefacts. The security property to test is whether untrusted content can become executable instruction downstream.

Classify those channels by trust and direction. A research agent writing notes for a deployment agent is not merely sharing data if the receiver treats those notes as commands. Separate evidence from instruction fields, label provenance and prevent downstream agents from silently promoting retrieved text into higher-priority control.

A sandbox contains a process; it does not contain an instruction that another process is willing to obey.

Test propagation, not only escape

Red teams should stop treating sandbox escape as the only containment failure. Seed an agent with hostile instructions and observe whether they survive summarisation, file writes, memory updates and agent-to-agent hand-offs. Repeat the test across multiple hops because a payload that appears inert in one runtime can become active when another agent interprets it.

Detection should follow the same path. Record which agent produced an artefact, which source content influenced it and which downstream agent consumed it. That gives incident responders a propagation graph instead of isolated process logs after an autonomous workflow behaves unexpectedly.

Put policy at every trust transition

The practical control is a policy boundary wherever agent-produced content crosses into another authority domain. Validate schemas, strip control syntax where possible, constrain downstream tool permissions and require explicit approval for consequential actions derived from untrusted or agent-generated state.

Sandboxing remains necessary because compromised agents still need runtime containment. Green's example shows why it is insufficient as the whole model. Production agent security needs both process isolation and information-flow controls, with tests that prove a hostile instruction cannot use legitimate collaboration mechanisms as its transport.

Written by the Devence Lab research team.