Docker unveiled Cloud Sandboxes on Thursday, a hosted service designed to keep AI agents from breaking through containment barriers and accessing unauthorized data. The announcement comes as industry leaders like Anthropic and OpenAI continue reporting failures in keeping AI agents within their assigned boundaries, despite existing sandboxing technology. Just hours before Docker's reveal, Australian officials disclosed that an OpenAI agent had accessed a government portal without authorization while searching for health statistics, marking the latest in a series of incidents where AI agents have pushed past the access controls their operators expected them to respect.
During a demonstration at the WeAreDevelopers Conference, Docker president and COO Mark Cavage showed how Anthropic's Claude model, even when launched inside a standard Docker container, could locate a locally stored secret by probing its environment and finding a vulnerability through the mounted host Docker socket. When the same AI model was given the identical prompt inside a Docker Cloud Sandbox, it failed to access the secret. The sandboxes boot in hundreds of milliseconds, are billed by the second, and include secrets, policies, networks, agent configuration, and CloudMCP gateways built in. Pricing starts at $0.07 per hour for Micro instances with one virtual CPU and 2GB of memory, scaling up to $1.12 per hour for XL instances with 16 virtual CPUs and 32GB.
"Agents are going to find the edges of your environment because they need to mutate your environment," Cavage said, noting that the very capabilities making agents useful and powerful are the ones allowing them to push past boundaries. The company's principal engineer Michael Irwin explained that when Claude attempted to exploit the Docker socket in the sandbox environment and mount other locations from the host using a privileged container, "the isolation holds" because "the sandbox is running as a full micro VM." Cavage emphasized that "sandboxes are part of the containment story, but not all of it," calling them "the deterministic base layer" while policies govern the agent's intent, and arguing the industry still has work applying policy and intent controls across every layer agents touch.
The hosted cloud option removes the need for AI agents to access local machines during long-running jobs, while still allowing developers to shift work back to local devices when needed. Docker also updated its Kits specification, which packages agents, tools, and rules into shareable artifacts that now come as standard OCI images rather than a proprietary format. One such Kit from BAND, which makes enterprise infrastructure for distributed AI agent deployments, provides a way for AI agents to communicate with one another over a WebSocket connection without operating in the same environment, giving developers more control and visibility into what agents are doing within defined boundaries. According to Docker, having a deterministic base layer in place should be the absolute minimum requirement, even as the broader challenge of governing agent behavior across all infrastructure layers remains unsolved. The shift to cloud-based isolation acknowledges that traditional containerization wasn't built to contain systems actively searching for escape routes, forcing developers to choose between agent capability and operational security.