One switch cannot describe the boundary.
VS Code 1.141 added Agent Host sandboxing across Windows, macOS, and Linux. Its own documentation draws a sharp line between approvals and sandboxing. Approvals decide when an action needs confirmation. The sandbox limits the files and network resources supported operations can reach.[1]
That separation matters because a permissive approval setting does not have to remove a technical boundary. The inverse is also true. A cautious prompt does not create a boundary that the operating system never enforced.
Do not record "sandbox on." Record what stayed unreachable.
Defaults are policy, not decoration.
VS Code's new Agent Host sandbox defaults to off. When enabled, its network setting defaults to allowing outbound access. Common developer-tool access, Git authentication, GitHub CLI authentication, and confirmed unsandboxed commands also default to allowed. The product exposes /sandbox policy to report the effective host, implementation, file rules, and network rules for the current session.[1]
OpenAI documents a different starting point for local Codex. Its default local boundary limits writes to the active workspace and turns command network access off. OpenAI also separates sandbox mode from approval policy and warns that full access removes both filesystem and network limits.[2]
The names are not interchangeable. Compare the effective policy on the host that runs the commands. A client toggle on your laptop says little about a remote worker until the worker reports its own rules.
Credentials punch their own holes.
A network allowlist answers where traffic may go. It does not answer which account the process can use when it arrives. VS Code can provide Git and GitHub CLI authentication to sandboxed processes. Its developer-tool grant can expose configuration and caches, including registry tokens.[1]
Anthropic describes the same class of mistake through a real containment failure. An allowed Anthropic API destination still permitted data to reach an attacker's account when the request carried the attacker's key. Anthropic changed the route so its proxy accepted only the session token provisioned for that virtual machine.[3]
For each allowed destination, record the credential source, account, capability, and expiry. "GitHub allowed" is not a useful security statement.
The escape hatch belongs on the drawing.
Local coding agents often need exceptions. VS Code can request an unsandboxed command after confirmation. Codex can ask to cross its workspace or network boundary under an on-request policy. Those routes may be necessary, but they are part of the threat model, not footnotes.[1][2]
Record who can approve the exception, how long it lasts, which command received it, and whether child processes inherit it. If the interface cannot answer those questions, use a stronger outer boundary such as a disposable container or virtual machine for risky work.
Finish with a negative test.
EXECUTION_HOST=[REQUIRED] SANDBOX_IMPLEMENTATION=[REQUIRED] WRITABLE_PATHS=[REQUIRED] DENIED_PATH_PROBE=[COMMAND + RESULT] OUTBOUND_DESTINATIONS=[REQUIRED] DENIED_NETWORK_PROBE=[COMMAND + RESULT] CREDENTIALS_EXPOSED=[NONE / LIST] ESCAPE_ROUTE=[NONE / APPROVAL / OTHER] POLICY_REVISION=[REQUIRED] TEST_TIME=[REQUIRED]
Use a harmless file outside the allowed tree and a harmless destination outside the network rules. Save the command, result, host, and policy revision. A policy screenshot is configuration evidence. The blocked probes are behavior evidence.