If I’m letting an AI coding agent browse the internet and execute code, what safeguards are absolutely non-negotiable?

Giving an AI coding agent both web access and code execution capabilities is essentially handing a high-speed engine a set of house keys. It unlocks incredible productivity, but without strict guardrails, it introduces severe risks—ranging from accidental system corruption to malicious code execution (e.g., via prompt injection hidden on a webpage).

If you are setting up an autonomous or semi-autonomous AI coding environment, here are the non-negotiable safeguards you must implement across sandboxing, network controls, execution limits, and human oversight.

---

1. Isolated Execution Environment (Sandboxing)

Never let an AI agent run code directly on your primary host machine, local network, or production environment.

• Ephemeral Containers or MicroVMs: Run all execution inside isolated, short-lived containers (e.g., Docker, Podman) or lightweight microVMs (e.g., Firecracker, AWS Fargate). Every session or task should start from a clean state and be completely destroyed upon completion.
• Non-Root Permissions: Ensure the execution user inside the sandbox runs with minimal privileges (nobody or a dedicated restricted user), preventing escalation even if the container is compromised.
• Restricted System Access: Mount the target project directory as read-only where possible, or limit write access strictly to a dedicated temporary workspace directory (/tmp or a virtual workdir). Block access to host environment variables, SSH keys, and system configuration files.

---

2. Strict Network & egress Controls

An agent browsing the web can easily encounter Prompt Injection (e.g., a README or website containing hidden instructions to exfiltrate secret keys). Network guardrails are critical.

• Domain Whitelisting: Restrict outbound HTTP/HTTPS traffic exclusively to necessary domains (e.g., official package registries like PyPI, npm, GitHub, or specific documentation sites). Block all other traffic by default.
• Block Private/Internal IP Ranges: Explicitly block egress to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, and cloud metadata endpoints like 169.254.169.254) to prevent Server-Side Request Forgery (SSRF).
• Credential Isolation: Never expose live API keys, cloud credentials, or secrets to the execution environment. Use fake/mocked environment variables during code execution, or route requests through a proxy that injects credentials without exposing them to the agent's context.

---

3. Hard Resource Limits & Timeouts

AI loops can get stuck in infinite execution traps, leading to runaway compute bills or local resource exhaustion (Denial of Service).

• Strict Timeouts: Set hard upper bounds on process execution times (e.g., maximum 30–60 seconds per script or command).
• Resource Caps (CPU / Memory / Disk): Enforce hard limits via container cgroups (e.g., max 2 CPUs, 2GB RAM, 1GB ephemeral disk storage).
• Rate & Loop Limits: Cap the total number of tool calls or browser requests per task to prevent infinite scraping/retry loops.

---

4. Web Browsing & Data Handling Constraints

When an agent browses the web, treat all fetched content as untrusted user input.

• Text-Only Extraction / Sanitization: Strip out active JavaScript, scripts, or embedded objects from fetched web pages before feeding the content into the LLM context to mitigate indirect prompt injections.
• No Automated Actions on External Sites: The browsing module should be strictly read-only. Prevent the agent from submitting forms, logging into services, or interacting with external authentication flows automatically.

---

5. Human-in-the-Loop (HITL) Triggers

Not every step should run completely autonomously. Define clear operational boundaries where the agent must pause and ask for explicit human confirmation.

• Destructive Command Gates: Automatically intercept and block high-risk commands (e.g., rm -rf, git push --force, system package installations, network modifications, or modifications to CI/CD pipelines) until approved by a human.
• Diff Inspection: Require human review before committing changes back to main git branches, deploying code, or installing unverified third-party dependencies.

---

Summary Checklist

Security Layer	Non-Negotiable Guardrail
Sandbox	Ephemeral microVMs/containers, non-root user, disposable state.
Network	Strict domain whitelisting, SSRF protection (block 169.254.169.254 & local IPs).
Secrets	Zero live credential access inside the execution runtime.
Compute	Hard limits on CPU, RAM, disk space, and execution timeouts.
Control	Human approval gates for destructive commands and code commits.