Why Agents Need Private Networks
A sandbox with only public internet access limits what an agent can do. Debugging a failing staging deploy means reading the staging database. Security testing means reaching services that should never be public. An agent working on a customer's infrastructure needs to reach that customer's network, often under a requirement that traffic never crosses the public internet.
Opening those services to the internet so the sandbox can reach them is the wrong trade. The better design puts the sandbox on a private network, connects that network to yours, and treats the sandbox's network policy as the security boundary.
Start from Deny-by-Default
A prompt-injected agent does whatever the injected text says, with whatever network access it has. The safe starting point is a VM that reaches nothing until you allow it.
Freestyle VMs work this way. The firewall is deny-by-default, and every VM declares its allowed traffic at creation. For outbound HTTPS, TLS rules add named paths through the platform edge. Skip the raw-IP egress rule, name the domains the agent needs, and you get a domain allowlist without writing a proxy.
Package registries and APIs sit behind CDNs whose IPs change. Granting access by hostname at the TLS layer holds up where IP allowlists break.
Private VPCs Between Sandboxes
Multi-VM setups are common: an agent VM, a database VM, a service under test. They should talk over private addresses, not public domains.
A Freestyle VPC gives every member an IPv4 address from a /24 and an IPv6 address from a /64. Membership alone does not grant access; the VPC's firewall rules decide who reaches whom. You can pin addresses to identify which VM sent a request, and route a VPC's traffic through a router VM you control. The Freestyle VPC docs walk through the setup.
Reaching Your Own Network
To bridge a sandbox network and your infrastructure, Freestyle uses WireGuard. A tunnel is a lasting WireGuard identity: create it once, save its config, and attach the private networks it should reach. Attaching or detaching a network is an API-side routing change, so the config file never changes.
| Approach | Public exposure | Setup | Revocation |
|---|---|---|---|
| Expose service publicly + IP allowlist | Yes | Low | Edit allowlist |
| Bastion host + SSH forwarding | Bastion only | Medium | Rotate keys |
| Private VPC + WireGuard tunnel | None | Medium | Detach network via API |
The same tunnels let you route sandbox traffic out through your own egress IP, which matters when a customer's firewall only admits traffic from known addresses. See Freestyle tunnels.
Keep Credentials Out of the Sandbox
Anything inside the sandbox, the agent can read. An API key in an environment variable is one env command away from the model's context, and from there one prompt injection away from leaving.
Edge credential injection closes that path. The VM sends an unauthenticated request; the platform edge adds the real credential as the request leaves. The agent can call the service and never holds the secret. Freestyle has guides for doing this with OpenAI, Anthropic, and OpenRouter, private Git remotes, and databases like Neon.
This also works for model calls. Point the agent at an OpenAI-compatible endpoint, such as Morph's coding models, and inject the key at the edge. Rotating the key or switching models happens in your controller, with no VM rebuild.
Multi-Tenant Isolation
Network per tenant
Each customer's VMs join that customer's VPC. A VM joins at most one VPC, so there is no accidental bridge between tenants.
Scoped identities
Identity tokens grant access to specific VMs for SSH or client sessions. An end user can operate their VM and nothing else.
Slugs keyed by user
Address VMs by an account-local slug like a user or project ID instead of tracking opaque IDs in your own database.
Forward auth at the edge
Authorize public HTTP requests at the edge before they reach a VM, so a preview URL is not an open door.
Frequently Asked Questions
How do I connect a sandboxed AI agent to a private VPC?
Put the sandbox on a private network and join that network to yours over an encrypted tunnel such as WireGuard. The agent then reaches internal services by private IP, and nothing needs a public endpoint.
How do I stop an agent from leaking API keys?
Never put the keys in the sandbox. Inject credentials at the network edge as requests leave the VM, so the agent can call the service but cannot read, print, or exfiltrate the secret.
Should agent sandboxes have open internet access?
Only when the task needs it. Deny-by-default egress with named allowances limits what a prompt-injected agent can reach. Open access is simpler but makes every page the agent reads a potential exfiltration path.
How do I isolate sandboxes for different customers?
Give each tenant its own private network and scoped identities. VMs on different networks cannot reach each other over private addresses, and access tokens are limited to the VMs that tenant owns.
Detect Injected Agents Per Turn
Network policy limits what a compromised agent can reach. Reflex flags jailbreaks and policy violations on every turn in under 90ms.