Skip to main content
AI agent sandboxDisposable. Isolated.

A sandbox for AI agents.Review the boundary.

An AI agent sandbox separates browser work from the host environment. Its real boundary depends on permissions, credential scope, network access, and retention. Test each control before use.

Explore the agent skillSee how it works
  • Off-device browser work
  • Scoped credentials
  • End the session
the boundaryREVIEW
AGENT

Task scope

browser actions. selected sites. required data.

YOU

Outside scope

local profile. unrelated credentials. host files.

one boundary decides the blast radius.

[ THE CONCEPT ]

What a sandbox is.
Why it matters.

A sandbox is an isolated environment. Its boundary comes from permissions, mounts, network access, credentials, and retention. The label alone proves nothing.

Isolation matters because agents read untrusted pages. A single poisoned page can rewrite an agent's instructions. That is prompt injection. A local run may inherit browser profiles, files, credentials, and network access you grant.

Route browser work through an isolated session to separate it from your local browser profile. Then test what the agent can still reach. For the broader threat model, read how Legba isolates browser work for agents.

[ REVIEW CRITERIA ]

The controls to verify.

Check permissions, credential scope, network access, retention, and teardown. Each control changes the effective boundary.

Inside the sandbox

Give the task a browser.

Route the browser step through an isolated session. Test the exact actions, domains, and permissions the task requires.

Outside the sandbox

Keep browser work off your device.

Legba's agent skill routes browser work through an isolated session. Do not mount local resources the task does not need.

Identity boundary

Scope identity explicitly.

Supply only the cookies and credentials required for the task. Verify storage and retention behavior before use.

On close

End the session.

Destroy the session when the work ends. Review retention limits before use.

[ HOW IT WORKS ]

Three steps.
One boundary to verify.

Add the skill. Route the task. Close the session. Verify what remains before production use.

Use the ready agent skill.

The public agent path provides routing and isolated browser sessions. Review its requested permissions first.

Route the browser work.

Send the browser step through the isolated session. Keep local files and unrelated credentials outside the task scope.

Close and verify.

End the session when the work is done. Check retention, logs, storage, and credential cleanup before production use.

Go deeper: read how to run Claude computer use safely or the full OpenClaw browser-isolation guide.

[ USE CASES ]

Browser tasks to isolate.

Autonomous coding agents

Separate browser work from your shell.

Route browser steps through an isolated session. Do not grant local filesystem or credential access unless the task requires it.

Computer-use agents

Give computer-use agents an isolated browser.

Computer-use agents click, type, and navigate like a person. Route browser work through an isolated session. Test how permissions change the blast radius.

Scraping that touches real sites

Separate scraping from your local browser.

Scraping reads untrusted pages, which is where indirect instructions can hide. Use an isolated browser session, scope credentials, and verify retention after close.

[ TWO JOBS ]

Infrastructure,
then browser isolation.

Browser infrastructure for agents, like Browserbase, Steel, or Anchor, focuses on scale and reliability. Legba focuses on routing and isolation. Different jobs. Teams often need both.

Primary job
Infrastructure: Scale and reliability for agent browsing
Legba: Routing and isolated browser sessions
What you provision
Infrastructure: Browser sessions at volume, behind an API
Legba: A ready skill for agent browser tasks
Isolation from your machine
Infrastructure: Varies by setup and configuration
Legba: Browser work runs off your device
Persistence between runs
Infrastructure: Often configurable for reuse
Legba: Verify retention for your environment
Setup
Infrastructure: SDK, keys, and integration work
Legba: Ready agent skill
Best paired with
Infrastructure: High-volume, repeatable agent traffic
Legba: Browser tasks that need routing and isolation

If you run high-volume agent traffic, browser infrastructure earns its place. If a run touches real sites and could be hijacked, it needs a blast-radius boundary too. The OpenClaw browser-isolation guide shows how to review that boundary.

[ AGENT SKILL ]

Use the published path.

Legba publishes no separate OpenClaw price. The ready agent skill provides the current path for agent routing and isolation.

[ FAQ ]

Sandbox questions.

What is an AI agent sandbox?
An AI agent sandbox separates an agent workload from the host environment. Its real boundary depends on permissions, mounted resources, network access, credential scope, and retention. No sandbox removes prompt-injection risk, so test those controls directly.
Why does an AI agent need a sandbox?
Agents read untrusted web pages, and a single poisoned page can rewrite an agent's instructions. That is prompt injection. A local run may inherit host permissions. An isolated run can narrow that boundary, but only if permissions, mounts, credentials, network access, and retention are scoped correctly.
How is Legba different from Browserbase, Steel, or Anchor?
Those products provide browser infrastructure for developers. Legba is a Chrome extension plus a ready agent skill for routing and isolated browser sessions. Compare the product type, connection method, permissions, credential scope, and retention before choosing.
Does the sandbox keep cookies or sessions between runs?
Do not assume. Check cookie, storage, credential, log, and retention behavior in the exact environment you plan to use. Close the session when the task ends and verify what remains.
What can I run inside the sandbox?
Legba's current public agent path is the ready skill. It gives agents browser routing and isolated sessions. Confirm compatibility, permissions, and credential handling in your own OpenClaw setup.
How much does the AI agent sandbox cost?
Legba publishes no separate OpenClaw price. The current public agent path is the ready agent skill.

Related surfaces

Review the browser boundary from every angle.

Use these pages to evaluate the agent skill, the browser-session boundary, and the controls to verify.

Agent surface01

Use the agent skill with OpenClaw

Review the browser-routing path, permissions, credential scope, and retention.

Explore
Guide02

Review a Claude browser task

The sibling guide covers browser isolation, permissions, credentials, and retention.

Explore
Isolation03

How Legba isolates browser work for agents

The broader case for separating browser work from your stack: prompt injection, permissions, and blast radius.

Explore

Use the internet without the internet using you.

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.