Best open-source AI repos for sandboxing AI agents (2026)

What is the best open-source sandbox for running AI agents safely?

The best open-source AI repos for sandboxing AI agents right now are NVIDIA OpenShell, Anthropic Sandbox Runtime and Cua. Anthropic Sandbox Runtime is the lightest option (OS-level file and network limits, no container); NVIDIA OpenShell gives each agent a sandbox with a policy check on every network connection and keeps real credentials away from it; Cua gives an agent a full disposable desktop, and SPACE runs code in Firecracker microVMs behind an HTTP API.

Comparison

Repo	What it does	Stars	Start here
NVIDIA OpenShell NVIDIA/OpenShell · Rust	OpenShell is NVIDIA's open-source runtime for running autonomous AI agents safely.	19,531	Run a coding agent in a locked-down sandbox Intermediate, 30 minutes
Anthropic Sandbox Runtime anthropics/sandbox-runtime · TypeScript	Anthropic Sandbox Runtime (srt) is a lightweight tool that enforces filesystem and network restrictions on any process at the OS level, without a container.	6,512	Sandbox an MCP server with one line in .mcp.json Beginner, 15 minutes
Cua trycua/cua · Rust	Cua gives AI agents computers they can use.	31,034	Spin up a disposable Linux sandbox for an agent Beginner, 15 minutes
SPACE (Perplexity) perplexityai/SPACE · Rust	SPACE is a Rust sandbox platform that runs code in isolated Firecracker microVMs, controlled through an HTTP API.	1,846	Run agent-written code in an isolated sandbox Intermediate, 2 hours
Strands Box strands-agents/box · Rust	Strands Box is an open source Rust sandbox engine that restricts what AI agents can execute, read, write, and reach on the network.	453	Run a coding agent inside a restricted Box sandbox Intermediate, 60 minutes

When to pick which

NVIDIA OpenShell NVIDIA/OpenShell

OpenShell is NVIDIA's open-source runtime for running autonomous AI agents safely. Each agent gets an isolated sandbox where kernel controls confine file access and system calls, every network connection passes a policy check, and real credentials are only added to requests bound for approved endpoints. Policy changes are checked with formal verification and risky new access waits for human review.

Best for: Developers and platform teams who want coding agents to install packages, call APIs and use credentials without giving them the whole machine.

Needs: Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental); Docker, Podman, or host virtualization; An agent to run inside the sandbox; the default image is minimal Ubuntu with no agent installed; For Kubernetes: Helm and a CNI that enforces NetworkPolicy

Start here: Run a coding agent in a locked-down sandbox Intermediate, 30 minutes, works with claude-code, codex, cursor

Run curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh to install the CLI and a local gateway
Run openshell sandbox create --name demo to create your first sandbox
Follow the Run Your First Agent guide in the docs, which runs OpenCode against a free OpenRouter model inside the sandbox
When the agent needs new access, approve it from OpenShell instead of granting it up front

All 3 use cases GitHub

Anthropic Sandbox Runtime anthropics/sandbox-runtime

Anthropic Sandbox Runtime (srt) is a lightweight tool that enforces filesystem and network restrictions on any process at the OS level, without a container. It uses sandbox-exec on macOS, bubblewrap on Linux and a dedicated local account on Windows, plus proxy-based network filtering, and was built for Claude Code to sandbox agents, local MCP servers and bash commands.

Best for: Developers running AI agents, MCP servers or untrusted scripts who want a quick allowlist for files and network without setting up Docker.

Needs: Node.js and npm to install the CLI; macOS, Linux with bubblewrap, or Windows; Optional: a settings file at ~/.srt-settings.json; without one srt uses built-in defaults

Start here: Sandbox an MCP server with one line in .mcp.json Beginner, 15 minutes, works with claude-code, codex, cursor

Run npm install -g @anthropic-ai/sandbox-runtime
In .mcp.json, change the server's command to srt and move the original command into args, for example "command": "srt" with "args": ["npx", "-y", "@modelcontextprotocol/server-filesystem"]
Create ~/.srt-settings.json with filesystem rules (denyRead, allowWrite, denyWrite) and network rules (allowedDomains, deniedDomains)
Restart your agent and ask the MCP server to write to a denied path to confirm it gets EPERM

All 3 use cases GitHub

Cua trycua/cua

Cua gives AI agents computers they can use. The repository holds Cua Spaces (a desktop app that gives agents full macOS or Linux desktops on your Mac, other machines you own or your own cloud), Cua Driver for operating native apps and browsers, Lume for local macOS and Linux VMs on Apple Silicon, a Cua SDK and CLI for sandboxes, CUA-S1 decision models and Cua Bench for evaluating computer-use agents.

Best for: Developers building or running computer-use agents who need safe desktops, sandboxes and app automation instead of letting agents loose on their main machine.

Needs: macOS 26 or later for Cua Spaces; Apple Silicon for Lume VMs; macOS, Linux or Windows for the cua CLI and Cua Driver; Spaces is free for individuals; Pro and Teams are paid

Start here: Spin up a disposable Linux sandbox for an agent Beginner, 15 minutes, works with claude-code, codex, cursor

Install with curl -fsSL https://cua.ai/install.sh | sh (Windows uses the PowerShell installer)
Create a sandbox: cua sb create ubuntu --name dev
Run a command inside: cua sb exec dev uname -a
Take a screenshot with cua sb screenshot dev

All 3 use cases GitHub

SPACE (Perplexity) perplexityai/SPACE

SPACE is a Rust sandbox platform that runs code in isolated Firecracker microVMs, controlled through an HTTP API.

Best for: Platform engineers and developers who need a separate, isolated execution environment for agent or user code, reached over HTTP.

Needs: A host that meets the prerequisites in docs/installation.md; Docker-compatible local setup for a Kind cluster, as described in docs/installation.md; Bash for installation and cluster diagnostics; Git and Python 3.11+ and mdBook 0.4.52 only if you build the docs locally

Start here: Run agent-written code in an isolated sandbox Intermediate, 2 hours

Follow [Installation and configuration](docs/installation.md) to deploy SPACE in a local Kind cluster and authenticate.
Follow [Your first sandbox](docs/first-sandbox.md) to create a sandbox from a template and wait for readiness.
Create a command session, attach to it to start the process, and read the output and exit result.
Delete the sandbox when the run finishes.

All 5 use cases GitHub

Strands Box strands-agents/box

Strands Box is an open source Rust sandbox engine that restricts what AI agents can execute, read, write, and reach on the network.

Best for: Developers and security-minded teams who want to run AI agents with enforced file, program, and network limits on a Mac with Apple silicon.

Needs: A Mac with Apple silicon running macOS 15 or later; Node.js 22.21 or later from Homebrew, if you follow the getting-started guide; Access to Claude Opus 5 on Amazon Bedrock in us-west-2, if you follow the getting-started guide; A Rust toolchain via rustup, only if you build from source

Start here: Run a coding agent inside a restricted Box sandbox Intermediate, 60 minutes

Confirm you have a Mac with Apple silicon and macOS 15 or later.
Run curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh | sh
Run ./box-core/box --version to confirm the binaries unpacked into ./box-core.
Edit Box.toml to set the agent command and direct file and network grants, and edit policy.dw to set rules for operations Box checks.

All 4 use cases GitHub

Use cases for sandboxing AI agents

Run a coding agent in a locked-down sandbox NVIDIA OpenShell
Let agents use API keys they can never see NVIDIA OpenShell
Teach your coding agent to drive OpenShell NVIDIA OpenShell
Sandbox an MCP server with one line in .mcp.json Anthropic Sandbox Runtime
Keep agent shell commands away from your SSH keys Anthropic Sandbox Runtime
Change network rules while a sandboxed command runs Anthropic Sandbox Runtime
Spin up a disposable Linux sandbox for an agent Cua
Let an agent operate native desktop apps without taking your mouse Cua
Create a local macOS VM on Apple Silicon with Lume Cua
Run agent-written code in an isolated sandbox SPACE (Perplexity)
Point existing E2B Python SDK code at SPACE SPACE (Perplexity)
Build the SPACE guide and API docs on your machine SPACE (Perplexity)
Run a coding agent inside a restricted Box sandbox Strands Box
Keep API keys away from an agent with credential injection Strands Box
Audit every policy decision an agent made Strands Box

Questions

What is the best open-source sandbox for running AI agents safely?

Which repo for sandboxing AI agents is easiest to start with?

Anthropic Sandbox Runtime: its starter use case "Sandbox an MCP server with one line in .mcp.json" is rated Beginner and takes about 15 minutes.

How do I get started with NVIDIA OpenShell?

Run curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh to install the CLI and a local gateway; Run openshell sandbox create --name demo to create your first sandbox; Follow the Run Your First Agent guide in the docs, which runs OpenCode against a free OpenRouter model inside the sandbox. Full steps and a copy-paste agent prompt: https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/

Are these sandboxing AI agents repos free?

They are open-source projects on GitHub (check each license; some, like fair-code projects, limit commercial use). Some also sell a hosted version or need a paid model API key; the requirements for each repo are listed on this page.

How is this list of sandboxing AI agents repos chosen?

Deduped tracks the hottest AI repos on GitHub and writes step-by-step use cases from each README. For this page we picked the repos that do this job, ordered by fit and then GitHub stars. Repos with a risk flag or a retired page are left out. The page is rebuilt with the site; stars are as of the last build in 2026.

What is the best open-source sandbox for running AI agents safely?

Comparison

When to pick which

NVIDIA OpenShell NVIDIA/OpenShell

Anthropic Sandbox Runtime anthropics/sandbox-runtime

Cua trycua/cua

SPACE (Perplexity) perplexityai/SPACE

Strands Box strands-agents/box

Use cases for sandboxing AI agents

Questions

More answers