---
title: "Implementing a secure sandbox for local agents"
description: "Auto-approved terminal commands make coding agents more capable but increase the risk of destructive changes and secret leakage, while repeated approval prompts create approval fatigue. Over three months, the team rolled out a uniform sandbox API across macOS, Linux, and Windows, allowing agents to run freely inside controlled environments and request approval mainly for internet access. macOS uses dynamically generated Seatbelt profiles; Linux combines Landlock, seccomp, and overlay filesystems to enforce workspace and ignored-file restrictions; Windows runs the Linux sandbox through WSL2. Changes to tool descriptions and result rendering help agents recognize constraints and escalate instead of retrying failed commands. Production data reports that sandboxed agents stop 40% less often, and the sandbox now handles a third of requests on supported platforms, although native Windows isolation remains under development."
---

# Implementing a secure sandbox for local agents

[Cursor](https://yomu.fyi/company/cursor) · Ani Betts, Yash Gaitonde & Alex Haugland · Feb 18, 2026

**Type:** Problem & solution

## Summary

Auto-approved terminal commands make coding agents more capable but increase the risk of destructive changes and secret leakage, while repeated approval prompts create approval fatigue. Over three months, the team rolled out a uniform sandbox API across macOS, Linux, and Windows, allowing agents to run freely inside controlled environments and request approval mainly for internet access. macOS uses dynamically generated Seatbelt profiles; Linux combines Landlock, seccomp, and overlay filesystems to enforce workspace and ignored-file restrictions; Windows runs the Linux sandbox through WSL2. Changes to tool descriptions and result rendering help agents recognize constraints and escalate instead of retrying failed commands. Production data reports that sandboxed agents stop 40% less often, and the sandbox now handles a third of requests on supported platforms, although native Windows isolation remains under development.

## Context

Auto-approved commands expose users to destructive changes and secret leakage, while requiring approval for every command leads to approval fatigue as prompts accumulate and engineers manage multiple agents.

## Approach / What changed

A uniform sandbox API provides platform-specific controls: dynamically generated Seatbelt profiles on macOS, Landlock and seccomp combined with overlay filesystems on Linux, and a Linux sandbox running inside WSL2 on Windows. Agent tool descriptions and rendered errors were also updated to explain constraints and guide permission escalation.

## Takeaways

- macOS generates Seatbelt policies at runtime from workspace settings, administrator settings, and the user's .cursorignore, constraining the behavior of an entire subprocess tree.
- Linux combines Landlock's filesystem restrictions with seccomp syscall filtering and uses Landlocked copies of ignored files so sandboxed processes cannot read or modify them.
- Shell results now identify the sandbox constraint behind a failure and can recommend escalation, addressing repeated retries and improving offline evaluation performance.

**Tags:** [Linux](https://yomu.fyi/topic/linux), [Sandboxing](https://yomu.fyi/topic/sandboxing), [Security](https://yomu.fyi/topic/security)

- Source: [Cursor](https://cursor.com/blog/agent-sandboxing)
- Source URL: https://cursor.com/blog/agent-sandboxing
- Ingested by Yomu: 2026-09-02T11:44:16.174Z

[Read original post](https://cursor.com/blog/agent-sandboxing)