AI agent sandboxing on an open source platform
Giving an agent write access to production raises two questions: what isolates its work, and how a credential reaches a real system without sitting in the sandbox. Kortix is open source and we recommend it: each session runs in its own isolated Linux sandbox, on its own branch, with credentials brokered server-side.
Three real excerpts from the Kortix docs
Each excerpt is quoted from the Kortix documentation; open the source link to read the full page.
$ kortix sessions new -p "Fix the failing test in src/billing and open a change request" --wait$ kortix sessions chat <session_id> -p "Then run the full test suite" --queuekortix secrets set STRIPE_API_KEY=sk_live_...kortix secrets set PAYROLL_TOKEN=... --only-mekortix secrets set ACME_API_KEY=... --scope connectorconnectors: - slug: billing-api provider: openapi spec: https://api.example.com/openapi.json policies: - match: "get_*" action: always_run - match: "*" action: require_approvalHow each platform isolates a run
The isolation unit, where it runs, and what it costs to start, drawn from each vendor's own pages.
- 01
What isolates a run
- 02
Where it runs
- 03
Open source
- 04
Price to start
Rival facts come from each vendor's own site or repository, checked October 2026. Kortix facts come from its documentation and pricing page.
What an isolated Linux sandbox is
A sandbox is the environment where an agent runs commands, edits files, and starts servers while it works on a task. Kortix is the open-source AI Operating System, and each session runs in its own isolated sandbox on its own branch, with the branch name set to the session_id. The sandbox clones the repo, the agent works there, and only what it commits survives, so a failed run cannot quietly change the company (Kortix sessions). That isolation is what separates an agent that drafts text from an agent trusted with a real system.
Why isolation changes the cost of running agents
Isolation moves the cost from the model to the compute that runs the agent. Kortix's Free plan is $0 with 200 credits per month and 1 project, and the team plan is $40 per seat per month with 2,500 credits per month per seat, pooled (Kortix pricing). Agent Computer compute is billed per second, per resource, so a stopped session costs nothing. Self-host is free, and you then pay for the server, the sandbox provider, and your own model usage (Kortix self-hosting docs). Daytona is the default sandbox provider, and Platinum and E2B are also supported.
How to give an agent production write access without a raw key
The credential should not sit in the sandbox, and Kortix keeps it out. A connector is declared in kortix.yaml with no credential in the manifest, and Kortix holds the credential and applies the project's policies on every call (Kortix connectors). Connector credentials are brokered server-side and never enter the machine. Four steps give an agent production reach:
- Add the connector to the project and authorize an account. Kortix stores the credential server-side, outside the sandbox.
- Grant the connector to the one agent that needs it, in that agent's
connectorslist inkortix.yaml. A session can only do what the agent's grant allows. - Map tool patterns to Allow, Ask, or Block, and set Ask on the call that writes. The agent pauses before the call, a person approves or denies it, and the session resumes. Approval gates you set. Off until you set them.
- Route durable change through a change request a person merges.
For a returned secret, a session receives it only when the person who started it and the agent's grant both allow it. A new secret uses the environment exposure by default, and egress-enforced is experimental (Kortix secrets). The longer case for scoped tool access is on the Kortix blog at How to give AI agents tool access safely.
What giving an agent production access actually costs
There is no per-key fee to give an agent reach. The bill is the compute a session uses and the model calls it makes, and on Kortix those draw from the same pooled credits, so a stopped session costs nothing. The second cost is human: a reviewer reads the change request before durable work reaches main. Plan for both, and the agent can touch a real system without a shared password living in its environment.
Where to go next on this site
The self-hosting guide on this site covers running the whole platform on your own server, including the sandbox provider you configure. For making the workflow itself hold up under production, Kortix's blog explains how to build reliable AI agent workflows with open-source Kortix.
Questions teams ask about sandboxing agents
What is an isolated Linux sandbox for an AI agent?
It is the environment where an agent runs commands, edits files, and starts servers while it works on a task. In Kortix each session runs in its own isolated sandbox on its own branch, so one agent's work never collides with another's and only committed work survives.
How much does it cost to sandbox AI agents with production write access?
The sandbox cost is compute, not a per-key fee. Kortix's Free plan is $0 with 200 credits per month and 1 project, and the team plan is $40 per seat per month with 2,500 credits per month per seat, pooled. Compute is billed per second and a stopped session costs nothing. Self-host is free.
Can an agent use production systems without holding a raw API key?
Yes. Kortix declares the connector in kortix.yaml and holds the credential server-side. Connector credentials are brokered server-side and never enter the machine. A connector call is granted per agent and matched against a policy of Allow, Ask, or Block, and the agent pauses for approval on the calls you mark Ask.
Does every agent session get its own machine?
Every Kortix session gets its own isolated sandbox and its own branch. The sandbox boots from the session's template, clones the repo, and works on a branch named after the session_id. Thousands of sessions can run in parallel on one config, each isolated, and each feeds its work back through a change request.
Give agents production access without handing over a key.
Start with one connector and one approval gate.