01
the page is untrusted input
prompt injection doesn't need your permission. when a hostile page convinces your agent to run something, the something runs inside the sandbox, not on your infrastructure.
back to microsandbox
use case / browser agents
browser agents click things. give the whole session a boundary.
a browser agent doesn't just browse. it downloads, executes, and follows instructions from pages you don't control. put the browser, the downloads, and the shell inside one disposable computer.
02
one boundary for browser and session
the browser process, its downloads, and any shell the agent opens share one microvm. close the task and the whole machine disappears.
a downloaded file can execute or spawn more processes without crossing into your host or another browser session.
03
the network is part of the boundary
by default, sandboxes can reach the public internet. private, host-local, link-local, and metadata destinations are blocked. egress can be reduced to an allowlist or disabled entirely. in the cloud, the non-public block cannot be lifted, even by you.
credentials are destination-bound. the sandbox works with a placeholder; the real value is substituted host-side into supported intercepted outbound requests, only for destinations on your allow-list. an approved destination still receives the real credential and could reflect or misuse it, so scope your allow-lists accordingly.
04
bring a browser image you have tested
bring a tested oci image. microsandbox does not ship a browser image, cdp gateway, proxy rotation, captcha handling, or session replay.
you choose the browser and automation stack. microsandbox supplies the machine boundary around it.
05
keep the runtime portable
one sdk. one api. local or cloud is a config change, not a rewrite.
the browser image and task policy remain explicit when the workload moves between a laptop and managed capacity.
how it works
one boundary for the whole browser task
01
bring a browser image
choose a tested oci image with the browser and automation tools the task needs.
02
start one microvm
the browser, downloads, shell, and child processes share one isolated guest machine.
03
apply the network policy
limit the destinations the session can reach before the agent opens a page.
04
close the task
remove the sandbox and the browser session, downloads, and machine disappear together.