A Copilot agent is given an MCP tool that executes arbitrary shell commands on a build server to run tests. The tool runs with the same user account that owns the build server's CI/CD credentials. A security engineer proposes sandboxing. Which sandboxing approach provides the strongest security boundary for this tool's execution environment?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Sandboxing is like giving someone a workshop with only the tools they need, in a room with no outside connections, and a door that disappears when they leave. Even if the agent (or an attacker controlling it) tries to escape, the container boundary, network isolation, and credential separation contain the blast radius to that ephemeral environment.
Full explanation below image
Full Explanation
When an MCP tool executes shell commands, it is the highest-risk tool type in any agent's toolkit. The sandbox must address three threat vectors:
1. Lateral movement via credentials: If the tool runs with the same account that holds CI/CD credentials, a malicious command can exfiltrate those credentials to an external server. The fix is a dedicated low-privilege user that has no access to production credentials.
2. Persistence: If the tool runs on a long-lived server with a persistent filesystem, a compromised run can install backdoors or modify build scripts. Ephemeral containers solve this: the container is destroyed after each run.
3. Network exfiltration: Without network isolation, a malicious command can call back to an attacker-controlled server with extracted secrets. Running the container with no network access (--network none) prevents this.
Option A (input validation on special characters) is brittle—attackers use base64 encoding, environment variable expansion, here-docs, and many other techniques to bypass character-level filtering. Option C (command length alerting) is a detection control with no prevention value; short commands can be highly destructive (rm -rf /). Option D (pre-approved binary list) is a stronger control than A but still insufficient on its own—a legitimate test runner binary can be exploited to run arbitrary code, and the container boundary prevents the blast from spreading beyond the sandbox.