We run agents that write and execute code inside closed boxes. The box protects the machine underneath. It does not protect the data.
Fact
The facts: on August 11 Vercel announced network controls for Vercel Sandbox. The firewall runs at host level and intercepts connections and name lookups before the code inside the box reaches them: domain filtering via the name in the TLS handshake, address-range restrictions, and windows during which connectivity is possible at all. Credentials are injected at TLS termination on the host and never enter the virtual machine. The feature is available on all plans, including the free tier.
Compute isolation answers one question: keep foreign code away from your machine. It does not answer the second one, which today is the expensive one. Code with a free path outward carries out whatever it has seen, without ever leaving the box.
The smart part here is where the key sits. Once the secret is injected at the boundary rather than inside, code that leaks out of the box carries nothing. There is nothing to steal from a place that never held it.
A locked room with an open window is not a locked room.
If you run agents, this week's question is one: how far does my agent reach when it asks. If the answer is anywhere, your box is decoration.
Official primary sources
Vercel Blog - A sandbox without a network boundary is only half a sandboxThe visual is generated code-art, no third-party images.