The only major coding-agent CLI that is sandboxed by default: workspace-write, network off.

OpenAI · cli · sandboxed by default · open source

Has a real native sandbox, but it is opt-in, the default posture runs with your full privileges behind approval prompts.

none

default, runs with your full OS privileges, gated only by approval prompts

container-ish

optional, opt in via /sandbox; @anthropic-ai/sandbox-runtime uses bubblewrap + seccomp on Linux, Seatbelt on macOS, with default-deny egress

Anthropic · cli · no sandbox by default

Sandbox is off by default; on Linux the only isolation option is a container (Docker/Podman), not native syscall confinement.

Google · cli · no sandbox by default · open source

A Gemini CLI fork with the same posture: sandbox off by default, container-only isolation on Linux.

Alibaba · cli · no sandbox by default · open source

No OS-level isolation at all, it runs with your full privileges, gated only by approval prompts.

Open source · cli · no sandbox by default · open source

No OS-level isolation, it runs with your full privileges, gated only by approval prompts.

Block · cli · no sandbox by default · open source

No OS-level isolation, it runs with your full privileges, gated only by approval prompts.

Sourcegraph · cli · no sandbox by default

The local IDE outlier: an OS sandbox is on by default for its terminal/fetch tools.

Zed Industries · editor · sandboxed by default · open source

Runs commands with full privileges plus a best-effort sandbox the vendor explicitly calls 'not a security boundary'.

Anysphere · ide-extension · no sandbox by default

Runs local commands with your full privileges, gated only by approval prompts; strong isolation is a separate cloud product.

Cognition · ide-extension · no sandbox by default

Runs local commands with your full privileges, gated only by approval prompts; no local OS sandbox.

Open source · ide-extension · no sandbox by default · open source

Runs local commands with your full privileges, gated only by approval prompts and prefix allow/deny lists.

Open source · ide-extension · no sandbox by default · open source

Runs local commands with your full privileges, gated only by approval prompts and permission lists.

Continue · ide-extension · no sandbox by default · open source

Local, full privileges by default ('same access as you'); an opt-in preview sandbox and a --cloud mode exist.

GitHub · cli · no sandbox by default

Runs local commands with your full privileges, gated only by approval prompts; no built-in sandbox.

GitHub · ide-extension · no sandbox by default

The async PR bot runs in an ephemeral GitHub Actions VM with the best-documented default-on egress firewall of any tool here.

GitHub · cloud · sandboxed by default

The best-documented closed agent and the only one that names its primitive: a homegrown otterlink microVM.

Cognition · cloud · sandboxed by default

Runs a fresh GCP VM per task, but the underlying isolation technology is undisclosed.

Google · cloud · sandboxed by default

Mid-migration from hardened seccomp-bpf containers to microVMs; a given user may be on either backend today.

Replit · cloud · sandboxed by default

Open-source: each session runs in a Docker container by default (host network off).

All Hands AI · oss-framework · sandboxed by default · open source

Open-source: a container per task (via SWE-ReX), built for massively parallel runs.

Princeton NLP · oss-framework · sandboxed by default · open source

Asserts cloud sandboxing but does not disclose the isolation technology; its local droid exec CLI has no OS isolation.

Factory · cloud · sandboxed by default

Runs in an ephemeral cloud workspace, but the isolation technology is undisclosed.

Cosine · cloud · sandboxed by default

Runs hundreds of ephemeral cloud sandboxes in parallel, but the isolation technology is undisclosed.

Zencoder · cloud · sandboxed by default