What problem does it solve? When running AI agents in sandboxes—especially during evaluations—you need to control what the sandbox can reach on the network. Without egress control, an agent under test can look up answers, install packages to work around missing dependencies, or exfiltrate data, invalidating your results. ## Core Features & Use Cases - Deny-all-then-allow egress policies: Apply per-sandbox network rules using the E2B SDK vocabulary, with fail-closed behavior that refuses creates (HTTP 400) when the environment has no gateway. - Evaluation isolation: Cut a sandbox off from the internet entirely, or allow only a single host such as a model API, while keeping package indexes off the allowlist. - Environment gateway management: Enable the proxy sidecar at the environment level via abx update envs, since rules only take effect when the env carries a gateway. - Use Case: You are benchmarking an agent and must guarantee it cannot fetch answers. Enable the env gateway, create the sandbox with a deny-all policy, then verify isolation by running curl from inside the sandbox and observing it fail. ## Quick Start Ask the assistant to create a sandbox in an environment with the network gateway enabled, applying a deny-all egress policy that allows only the one host your task requires, then verify isolation by testing an outbound request from inside the sandbox.
