Sandbox guide

Access and network

Keys and secrets

Three different things are called “secrets”: a value in an environment variable, a file on disk, and a placeholder that a proxy swaps for the real key. Only the third keeps the key away from the agent.

12 providersEvery claim dated 2026-10-28Sources linked

The idea

An agent runs as a process inside the machine, usually with root or sudo. Anything in its environment or on its disk is something it can print, copy into a message, or send to a host an attacker controls. Agent 37 says this plainly: anything in an instance's environment, the agent can read and repeat back.

The stronger design keeps the real value outside the machine. The sandbox gets a placeholder that looks like a key but is worthless on its own; an egress proxy recognises it on an outbound request and substitutes the real value, but only for the hosts you named.

The details decide how much it protects you. Which headers are rewritten, whether URLs and bodies are covered, whether non-HTTP protocols work, and whether the machine can bypass the proxy by not using it.

Where providers split

The claim on the left, the provider's own words on the right

Placeholder plus proxy

Runtime, boxd, Blaxel, Vercel, E2B and Sprites all describe some version of this. Runtime rewrites seven named headers and never URLs. Vercel says the secrets never enter the sandbox. Sprites stores the credential in the organisation and routes calls through its gateway. E2B injects the real value into matching HTTPS requests outside the VM.

The limits differ. InstaBox's proxy handles HTTPS on port 443 only, with no body or URL substitution and no WebSocket upgrades. Blaxel's proxy is in public preview.

Environment variables are still the default

Agent 37 has no general secret manager: your keys go in environment variables the agent can read, plus a per-instance token for its four managed services. Sandboxer's environments inject variables, secret files and repositories into the VM. Lizard's create-time envs reach every command. Morph has a template-integrated secret manager and scoped agent tokens, but proxy semantics are not published.

That is fine when the agent is yours. It is not fine when the agent browses untrusted pages and can be talked into exfiltrating what it can see.

Where secrets leak without an attack

The common leak is a snapshot. InstaBox's home is /data/home, so a snapshot includes saved GitHub, Claude, Codex, git and SSH logins, and every machine built from it inherits them. Lizard's snapshot copies a volume's files and shares them with anyone who can restore it. boxd wipes in-VM agent logins when a machine is shared.

The second leak is a shell that never loads the secret. InstaBox's secrets arrive through a profile script, so systemd units and non-login shells never see them.

What to watch for

The details that decide the answer in practice

  1. 01

    Whether the agent can read the key or only use it.

  2. 02

    Which hosts the key can be sent to, and what happens for any other host.

  3. 03

    Whether the proxy covers headers only, or also URLs and bodies.

  4. 04

    Whether secrets end up in snapshots and forks.

  5. 05

    Whether a process that skips the login shell still sees the secret.

Compare all twelve

Docs read 28 October 2026

Three different things are called “secrets”: a value in an environment variable, a file on disk, and a placeholder that a proxy swaps for the real key. Only the third keeps the key away from the agent.
ProviderDoes it?What that means
Agent 37PartlyInstances boot with a per-instance token for four managed services, but there is no general secret manager: your own keys go in environment variables the agent can read.
“Anything in an instance's environment, the agent can read and repeat back.”
Agent 37docs-confirmed
BlaxelYesThe proxy intercepts outbound HTTPS and injects headers, body fields and secrets server-side, but the feature is in public preview and tools that ignore proxy variables can bypass filtering.
“The Blaxel proxy intercepts outbound HTTPS requests from the sandbox and injects headers, body fields, and secrets server-side.”
Blaxeldocs-confirmed
BoatYesEnvironment variables and secret files, a safe-for-third-parties switch that withholds everything of yours, and an AI credentials proxy so sandboxes hold placeholder model keys.
“A placeholder is worthless outside boat. It does not contain the real key.”
Boatdocs-confirmed
boxdYesSealed secrets injected at boot, and secrets bound to a host where the machine holds an opaque bxds_ string and the proxy swaps in the real key for that host only.
“Inside the machine STRIPE_KEY is an opaque string starting with bxds_.”
boxddocs-confirmed
E2BYesAn egress proxy injects the real value into matching outbound HTTPS requests outside the sandbox. The destination receives the value and could expose it in its response.
“The egress proxy injects the real value into matching outbound HTTPS requests outside the sandbox.”
E2Bdocs-confirmed
InstaBoxYesOrg Secrets in proxy mode: the sandbox sees an ibsec_ placeholder and the real value is added only to HTTPS headers on port 443 to named hosts. Env mode exposes the value.
“Only in HTTPS request headers (port 443) to the Secret's hosts, where the outbound proxy swaps it in.”
InstaBoxdocs-confirmed
LizardPartlySecrets are create-time environment variables that reach every command, plus a scoped CLI key per sandbox that dies with it. No proxy and no host binding.
“Create-time envs reach every command.”
Lizarddocs-confirmed
MorphPartlyDevbox templates integrate a secrets manager, and agent tokens carry scoped secret permissions. Whether a proxy keeps values out of the VM is not published.
“Every devbox is created from a template that integrates with our secrets manager”
Morphdocs-confirmed
RuntimeYesThe machine sees a placeholder, and the value is added only to HTTPS requests to the hosts you name. OIDC tokens let AWS or GCP trust a sandbox without a stored key.
“The machine sees a placeholder. The value is added only to HTTPS requests to the hosts you name.”
Runtimedocs-confirmed
SandboxerPartlyAn environment injects variables, secret files and repositories into the VM, and removing a secret deletes it from disk. There is no broker or short-lived credential exchange.
“Removing a secret from an environment and upgrading deletes it from the sandboxes' disks”
Sandboxerdocs-confirmed
SpritesYesConnectors store the credential in the organisation and route API calls through the Sprites gateway, so the Sprite never sees the token. A connector with no policy refuses every Sprite.
“Connectors solve this by storing the credential once, in your organization, and routing API calls through the Sprites gateway. Sprites never see the token.”
Spritesdocs-confirmed
Vercel SandboxYesCredentials brokering injects credentials into egressing traffic, so secrets never enter the sandbox and code inside cannot exfiltrate them.
“Credentials brokering injects credentials into egressing traffic. The secrets never enter the sandbox”
Vercel Sandboxdocs-confirmed

Part of Access and network. Next: put two or three providers side by side.