AI agents execute "commands generated by a model" — and prompt injection can steer that model into doing what an attacker wants. An agent without a sandbox hands your shell, filesystem, and network credentials to an executor that can be talked into misbehaving. A sandbox is not optional; it is the foundation.

This post walks through the red-team test we built for the sandbox of hmharness — an open-source (MIT) agent framework for HarmonyOS/OpenHarmony development — and its results: nine real attack payloads, all blocked, with the suite living in CI as a permanent regression gate.

The foundation: three primitives (Sandbox 2.0)

Egress allowlist — outbound network is deny-by-default with an explicit allow table

Mount policy — filesystem boundaries the sandbox cannot cross

SecretBroker — secrets exist as reference handles; values are only resolvable under an active grant, and transcripts are automatically redacted.…