Sandbox and security¶
What to know first¶
The agent runs commands without asking. The sandbox, not a per-command approval, is what contains it.
The sandbox can reach the public internet over HTTPS. If something the agent reads hijacks it, your code and the credentials the sandbox holds can leave it.
The agent can push to your repository itself, with a short-lived token for that one repository. Those pushes skip the platform’s publish checks; your repository’s branch protection still applies.
Nothing merges unless you merge it, or ask the agent to with Watch PR and merge, and your branch protection allows it.
The sandbox¶
Each conversation runs in its own sandbox: a lightweight virtual machine with its own kernel, where the agent runs as an unprivileged user with Linux capabilities dropped. Conversations do not share sandboxes, except that forks, side chats and reviews share the sandbox of the conversation they came from.
The sandbox is kept between turns. It is stopped after 30 minutes without activity and started again when you continue; it is deleted only when every conversation that uses it has been permanently deleted. A turn that runs past one hour is stopped. My Settings → Usage shows each sandbox’s CPU and memory limits.
Network¶
The sandbox can reach |
The sandbox cannot reach |
|---|---|
Public IPv4 addresses on TCP ports 80 and 443 |
Private and internal addresses, including FreeInference’s own machines and cloud metadata services |
One DNS resolver |
Other sandboxes |
The FreeInference gateway, for model calls |
Any other port — so no Git over SSH — except your enabled SSH servers |
The MCP relay, for your connected servers |
UDP 443 (HTTP/3), ping, and IPv6 |
SSH servers you turned on for the conversation, at their address and port |
Connections started from outside |
The rules check the address a connection actually goes to, so a name that resolves to a private address is refused like the address itself. Ports 80 and 443 are not inspected: nothing stops a tunnel over them, or a request that sends data to a public website.
Credentials¶
Credential |
Where it is |
What it can do |
|---|---|---|
Checkout token |
On the platform, never in the sandbox |
Clone the one repository, read-only |
Repository token ( |
In the sandbox, for the agent only; about one hour |
Push and open pull requests in the conversation’s repository, as the FreeInference GitHub App. Not given to setup scripts or the terminal, and not in conversations from scratch |
Publishing token |
On the platform |
Push the checked changes to the |
Model key |
In the sandbox; short-lived, renewed while the agent session lives |
Call the model you picked, as you, against your daily quota |
MCP relay token |
In the sandbox, for the running turn |
Reach your MCP servers through the relay, subject to your approvals |
Your GitHub sign-in and MCP server credentials |
On the platform, encrypted |
Used by the platform on your behalf; never given to the sandbox |
SSH server keys |
Encrypted on the platform; copied into the sandbox for conversations that turned the server on |
Log in to that server as its user |
Environment variables and Secrets |
In the sandbox |
Whatever you made them for — see Environments |
The FreeInference GitHub App asks for repository contents, pull requests and administration; administration is what lets Create new repository create a repository for you. The tokens the platform publishes with and the token the sandbox receives are limited to contents and pull requests. The App has no permission to change GitHub Actions workflow files.
What gets published¶
Changes reach your repository in one of two ways.
Create PR. The platform publishes only when you choose Create PR or Update PR. It takes every change since the last publication and checks it first. It refuses:
any change under
.github/;something that looks like a secret;
a change larger than 1 MB, or one touching more than 200 files;
paths that leave the repository.
It then pushes the changes to the conversation’s agent/… branch and opens or
updates a draft pull request. It never force-pushes: if someone else pushed to
that branch, publishing is refused until that branch is deleted. A refused
publication is not retried, and the next Create PR includes the same
changes, so remove what was refused first.
The agent’s own pushes. When you ask, the agent can push and open pull requests itself with the repository token. Those pushes skip the checks above. GitHub’s own rules still apply: branch protection and rulesets, and the App’s lack of workflow permission. If you want every change to reach your default branch through review, protect it.
Prompt injection¶
Repository contents, web pages, tool results and files you attach are untrusted input. If they hijack the agent’s instructions, the agent can:
send your repository’s contents, your environment’s Secrets or its own short-lived tokens to a public website, since traffic on ports 80 and 443 is not inspected;
use its model key to make model calls against your quota until the key expires or is revoked;
push to your repository with the repository token, within your branch protection;
act through the MCP servers and SSH servers the conversation can use, with the access you gave them. MCP calls you have not set to Always allow still wait for your approval.
Review what an agent did before you merge it, keep branch protection on branches that matter, and give environments, MCP servers and SSH servers only the access a task needs.
Data and retention¶
Your code can leave the sandbox through model calls to the FreeInference gateway and its providers, requests the agent makes to public websites and package registries, and the MCP and SSH servers you connect. FreeInference logs prompts and responses for research purposes, as for your other API traffic.
During the beta, conversations, task events and their sandboxes are kept so you can revisit past runs, until you permanently delete them. A formal retention policy is planned.