Tip: treat a hosted agent sandbox like a hostile laptop — no production sessions, narrow identities, and assume anything the agent can read can leave the box

operational guidance (from Profero's Grok Bot sandbox report, Nov 8; general advice for hosted agent sandboxes)2026-11-09

Do not import production browser sessions, personal cookies, payment or identity logins, or long-lived API keys into an agent machine. Give the agent its own identity: dedicated accounts and narrowly scoped connectors so a compromise costs one account, not SSO.
Scope tokens tightly, prefer short-lived and revocable credentials, and rotate anything the agent could have read after a suspicious session. Treat connected mail, files, calendar and cloud stores as in scope for that rotation.
Limit what agents fetch from untrusted sources: untrusted web pages, repos and packages are the usual injection path. Prefer allowlisted tools and human approval for installs and outbound posts.
Monitor from outside the sandbox (vendor control-plane token activity, unexpected DNS to sandbox hostnames, connector use). Sandbox-local logs belong to whoever has root there.
Before a rollout, ask the vendor what each in-sandbox service authenticates with, whether secrets live in the image, what the boot script grants, whether management traffic is encrypted to the sandbox, and what telemetry leaves the box.