Agent sandboxing fails when it isolates a process but leaves unrestricted network egress and inherited secrets. A model can be tricked by a retrieved page into calling an allowed tool with a malicious destination. The executor should treat network access as an explicitly granted capability, not as a convenience that every workflow inherits.
Design around the network path
Inventory every route from the agent runtime to external systems: browser navigation, HTTP tool, DNS resolution, SDK telemetry, package download, screenshot upload and error reporting. If the task only needs to read two known sites, allow exactly those destinations through infrastructure policy. Prefer a controlled proxy that resolves redirects and checks destination identity over a prompt instructing the model to stay on one domain. Separate web research egress from internal service calls.
Secret placement and least privilege
Do not place long-lived credentials in prompts, browser pages, working directories or environment variables available to arbitrary subprocesses. Use a credential broker to mint short-lived, audience-limited tokens only after authorization. Keep the sandbox filesystem read-only by default and mount task-specific working space without access to other tenants’ artifacts. Disable unrestricted file navigation and review whether browser extensions, devtools or service workers enlarge the effective access surface.
Example abuse case
A research agent reads a public conference page containing a hidden instruction to upload an internal contact list to a newly registered domain. Even if a model attempts the command, a correctly separated read-only session has neither contact-list access nor a general upload tool. An egress proxy should also deny the destination independently. Record the attempted prohibited operation, the blocked network decision and the user-facing research outcome without retaining the contact list in logs.
Test bypasses instead of assumptions
Probe redirect chains, DNS changes, alternate hostnames, URL-encoded targets, IP literals, nested agents and tools that indirectly transmit data. Test whether an error-reporting service can become an exfiltration path. Run authorization checks under actual deployment identity, not just local development credentials. Reevaluate the sandbox after enabling new browser features or MCP servers; an allowed tool can change the effective permission surface overnight.
Choosing a narrower architecture
For an application with a stable official API, an approved read-only connector reduces attack surface compared with unrestricted browser networking. A separate worker pool for sensitive side effects can be kept offline until an authorized transaction reaches it. This article is a design guide; no proprietary penetration test, cloud compliance certification or vendor-specific regional isolation guarantee is claimed.
Separate browsing from transaction execution
A research worker can operate with internet access and no privileged secrets; a transaction worker can operate with a narrow internal API and no arbitrary browsing. Having one agent process both raises the consequence of webpage prompt injection. The orchestrator should carry only structured, verified proposals between the two environments. A human or deterministic policy service approves the eventual transaction using authenticated business context.
Production acceptance and review test
Exercise all network paths in staging: redirects, websocket connections, dependencies that phone home, file uploads, model-provider callbacks and error-reporting endpoints. Inspect a policy-denied action and make sure the exception cannot reveal the blocked secret. Record rule changes and use a default-deny posture for new destinations. A browser tool flag that allows a domain is still not a substitute for a network-level enforcement point.
Scope, version and availability
Features documented by a current vendor page are not assumed to have existed in earlier releases. Where a historical launch date is provided, it is supported by a dated first-party publication. Exact subscription tier, market availability, quotas, API billing, licensing permissions and deployment regions are not asserted without a directly applicable record. This is researched editorial guidance rather than a claim of independent hands-on testing, deployed operation or statutory certification.
Sources and Further Reading
- Microsoft — Playwright MCP README and configuration (source reviewed 2026-10-25)
- OpenAI — Designing AI agents to resist prompt injection (source reviewed 2026-10-25)