An agent’s request to run a shell command can have broader effects than its natural-language plan describes. A command may invoke package hooks, send network requests or write outside the project. Sandbox controls therefore need to be assessed in three layers: which files can be read and changed, which processes may run, and where those processes can communicate.
What the official product can and cannot do
VS Code documents workspace trust as a boundary that can disable tasks and agents in untrusted projects, while explicitly warning that Workspace Trust cannot prevent a malicious extension from running arbitrary code. Amp’s May 2026 announcement illustrates a separate model: permissive default agent tool calls with optional permission plugins. Neither statement implies a universal kernel-level sandbox.
A practical evaluation workflow
Use a disposable repo in a container or VM running as a non-root user. Mount source read-write only where necessary, mount credentials nowhere, remove Docker socket access and deny outbound network by default. Execute benign probes that attempt to read a decoy file outside the workspace, write to an external directory and connect to a nonessential host. The expected result is an operating-system-level denial with logged evidence.
Limitations and historical pitfalls
Prompt rules such as “do not touch /secrets” are not enforcement. Command allowlists based on textual patterns can be bypassed through scripts or shell expansion. Network filtering at the UI layer is different from egress control for child processes. Git worktrees and filesystem snapshots do not reverse emails, API calls or other external side effects.
Data handling and permission boundary
Patch the sandbox image, pin dependencies and prohibit privilege escalation. Explicitly limit filesystem mounts, home directories, SSH agents, cloud metadata endpoints and loopback services. Treat MCP servers as additional process and network trust boundaries; granting an agent access to a server delegates part of the action surface.
Who should use this approach
A baseline for any organization allowing an AI assistant to run tests, installers or build steps. Higher-risk repositories need isolated execution and human release approval, not just a confirmation dialog.
Alternatives and trade-offs
Codex, Claude Code, Cline and IDE-integrated agents expose different policy knobs. Evaluate the actual executable environment instead of treating similar button labels as comparable guarantees.
Version, tier, region and evidence status
This article is an editorial snapshot checked against first-party material on 2026-10-25. Version or historical applicability: VS Code trust docs and Amp permissions docs at 2026-10-25. The exact software build in a reader’s organization, eligibility by country, enterprise agreement, separate provider model rates, code retention and full regional list have not been validated; such fields remain unknown rather than being guessed. Product statements are attributed to first-party descriptions, not independent hands-on tests. License guarantees, prices and seat limits require AI 10 dated snapshots or signed terms. Unverified details do not become timeless facts because they appear in current online documentation.
Deployment acceptance checklist
- Write the intended job and acceptance criteria; record the installed client release, plugin publisher, connected model/provider and tenant.
- Use a consented test repository with zero real secrets; capture installation permissions, processor regions, Git App grants and available audit logs.
- Verify the task boundary with a test that should fail when unauthorized: blocked file, network host or protected branch.
- Review proposed changes or comments against known requirements; run regression, security and integration checks independently of the agent.
- Document the owner, offboarding procedure, rollback limits and whether a formal procurement/privacy sign-off is still pending.
Sources & Further Reading
- https://code.visualstudio.com/docs/agents/concepts/trust-and-safety (official technical material; undated/living source; checked 2026-10-25)
- https://code.visualstudio.com/docs/editing/workspaces/workspace-trust (official technical material; undated/living source; checked 2026-10-25)
- https://ampcode.com/news/neo (official technical material; original date 2026-05-06; checked 2026-10-25)