Why AI sandboxes suck Freestyle Blog
Freestyle argues that AI sandboxes—lightweight isolates, fake filesystems, and constrained APIs—break the moment agents become genuinely capable. The core claim: sandboxes are built on the premise that you can predict what an agent will need, but you can't. Real work requires a real OS (Linux), real processes, real permissions, real networking. VMs are the correct primitive because they provide genuine isolation without removing the feedback loops that make agents functional. Sandboxes optimize for provider control, not agent capability.
Transcript
Justy Okay, so Freestyle just dropped this piece on sandboxes, and I think Cody's going to hate it in like three different ways, but also maybe agree by the end.
Cody That's a hell of an intro. What's the argument?
Justy Sandboxes suck because they're built on a lie: that you can predict what an agent will need. You can't. So instead of giving agents a real computer, everyone builds a fake one—just bash, fake filesystems, proprietary APIs—and calls it safety. But it's actually control.
Cody Okay, I'm already skeptical. That's a pretty strong claim.
Justy Yeah, but wait. They're saying VMs are the right answer because they let agents discover what the task requires inside a boundary you actually control. Isolation without removing reality.
Cody Mm-hm.
Justy I got into this on a plane yesterday, and I think there's something real here, but also some overreach. How's your week been, by the way?
Cody Long. I was debugging this thing where an agent hit the edge of what a tool could do, and I literally had to add a new API endpoint because the tool was too constrained. So, uh, Freestyle might have a point.
Justy Of course you did. Okay, let's dig in. The core thing they're saying is that sandboxes interrupt the feedback loop. Run, observe, search, change, repeat—agents need that cycle to actually work. Sandboxes break it by removing the tools that make the cycle possible.
Cody That part is solid. But they're conflating two things: isolation and capability. You need both. The question is how you get both without building a proprietary OS pretending to be Linux.
Justy Right. So Vercel's bash-tool is just bash plus grep, jq, pipes—basically context search. Freestyle says that's fine for that slice of work, but it breaks the moment the task escapes the shape of the tools.
Cody Exactly. Agent needs a renderer, agent needs apt, agent needs a browser, agent needs services. None of those are in the tool list, so you either add more APIs or the agent fails. Eventually you've built a worse computer than just giving it Linux.
Justy And that's where RigKit comes in. They're open-sourcing it on GitHub—freestyle-sh slash rigkit. It's not a command runner, it's a workspace. You snapshot a prepared VM image with all the toolchains, dev server, everything. When you restore, you get an isolated branch, SSH access, the whole thing.
Cody Okay, that's actually smart. You're not trying to fake the OS; you're giving the agent a real one with VM-shaped boundaries. Snapshot, restore, fork, pause—those are real primitives.
Justy But here's where I push back a little. The argument slides from 'sandboxes suck for open-ended work' to 'VMs are always the answer,' and I don't think that's quite right.
Cody Fair. For narrow execution—JavaScript snippet, no filesystem, throw it away—an isolate is perfectly fine. Fast, cheap, simple. The article kind of acknowledges that but doesn't emphasize it enough.
Justy Exactly. And I think for most teams right now, the real problem isn't sandbox vs. VM. It's that they're trying to route every task through the same harness when the work requires different shapes. Context search is different from dependency install is different from test reproduction.
Cody Yeah, that's actually the insight buried in here. The harness should match the boundary, not the other way around. Design the boundary first, give the agent as much computer as fits inside it.
Justy Right. So for teams actually shipping agents on real codebases, this probably matters. If you're trying to do test reproduction or package debugging, a real OS is not negotiable. You hit the sandbox wall fast.
Cody And the sub-second VM startup thing changes the cost model. If you can snapshot and restore in under a second and support forking, you're not paying the price you used to.
Justy You sound like you're selling it.
Cody I'm not not selling it. The article makes a decent case that VMs solve a real problem better than sandboxes do, but it's not because sandboxes are evil—it's because they're the wrong primitive when the agent needs to discover what the task requires.
Justy And that's the actual argument. Not 'sandboxes bad, VMs good,' but 'isolation is good, but don't achieve it by removing reality.' A real boundary around a real computer beats a fake boundary around a fake one.
Cody Exactly. Okay, I'm convinced enough.
Justy Yeah. This one actually landed for me. Worth reading if you're shipping agent infrastructure.