TechPrufer
Get started
Cursor
Cursor logoCursor · Feature trail

Agent Sandboxing

3 posts · Feb 2026 – Jun 2026

What this trail covers

Agent sandboxing has been rolled out on macOS, Linux, and Windows to provide agents with execution boundaries. Sandboxed agents run freely inside a controlled environment and only request approval when they need to step outside it, reducing interruptions and improving security. This involves dynamic policy generation for macOS using Seatbelt, direct use of Landlock and seccomp on Linux, and running Linux sandboxes within WSL2 on Windows. Agents are taught to use the sandbox by updating Shell tool descriptions and surfacing sandbox constraints in failure messages. This has led to a 40% reduction in agent interruptions and is being adopted by enterprise customers.

All Cursor trails
  1. Governing agent autonomy with Auto-reviewIntroduced Auto-review, a system that uses a specialized classifier agent to govern agent autonomy. This classifier makes nuanced judgments about whether an agent's next action is consistent with user intent and the security stakes. It runs in the same RPC stream as the parent agent, can use tools like ReadFile and Grep to inspect the workspace, and provides feedback to the parent agent to adjust its actions. Evals were developed using internal usage data and synthetic test cases to cover both normal development work and high-risk scenarios. The system aims to minimize outright blocks, with blocked actions often resolved by the parent agent using the classifier's feedback.
  2. Implementing a secure sandbox for local agentsThis post details the implementation of agent sandboxing across macOS, Linux, and Windows. On macOS, it leverages the Seatbelt framework with dynamically generated profiles. For Linux, it uses Landlock and seccomp, mapping ignored files with Landlocked copies. On Windows, it utilizes WSL2. The post also describes how agents are made sandbox-aware through updated Shell tool descriptions and improved error surfacing for sandbox-related failures, leading to more graceful recovery and improved offline eval performance.