Skip to content

docs: document sandbox clipboard writes #25947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dvdksn wants to merge 3 commits into
base: main
Choose a base branch
from
+5 −0
Open

docs: document sandbox clipboard writes #25947

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b18e163
docs: document sandbox clipboard writes
dvdksn Aug 27, 2026
f20ac18
docs: describe clipboard writes as host integration
dvdksn Aug 27, 2026
49bc6fb
docs: describe clipboard access directly
codex Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions content/manuals/ai/sandboxes/security/isolation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,11 @@ processes, files, or resources outside its defined boundaries.
The agent runs as a non-root user with sudo privileges inside the VM. The
hypervisor boundary is the isolation control, not in-VM privilege separation.

Processes in a local sandbox can write text to your host clipboard, but can't
read existing clipboard text. Host clipboard image reads are a separate,
opt-in feature. After running untrusted code, check clipboard contents before
pasting them on the host.

## Network isolation

Each sandbox has its own isolated network. Sandboxes cannot communicate
Expand Down