The agent harness should live outside the sandbox

Covers an architectural approach to where the Agent Harness—the loop that repeats the LLM's prompting and tool execution, which is the core of an AI agent—should be run.

The in-sandbox execution approach runs the loop and tools within the same container, offering the advantage of a simple structure and the ability to use existing tools as-is. However, it carries the security risk of credential leakage, and since the session is tied to the sandbox itself, it is difficult to scale.

In contrast, the out-of-sandbox execution approach runs the loop on the backend and accesses the sandbox via API only when a tool call is made. The main benefits of this approach are as follows:

• Enhanced security: Sensitive information such as API keys and user tokens is never exposed to the sandbox.
• Resource efficiency: The sandbox can be paused while the agent is idle, reducing costs.
• Recoverability: By treating sandboxes as disposable (Cattle), the loop can immediately provision a new sandbox if a failure occurs.
• Multi-user support: Shared memory and skills can be efficiently managed through a shared database rather than a distributed file system.

However, implementing this model requires a Durable Execution environment where the loop persists even through deployments or failures, as well as a design that accounts for environments without a local file system.