The agent sandbox, explained
What "Sandbox" means in Locally Uncensored, what it protects you from, what it does not, and how to use the agent safely on your own files. Written for version 3.0.6 from the app's source.
The short answer
The sandbox is a folder, not a separate computer. When you start an agent chat and choose "Sandbox", the agent gets an empty folder of its own under ~/agent-workspace. Its file tools can only read and write inside that folder. Its shell commands, once you approve them, run on your real computer as your own user. The app says this itself in the folder dialog: "Workspace protection is a folder path jail, not a container or virtual machine. Commands run on this computer. Review tool requests before allowing them."
So the sandbox protects your files from the agent's file tools wandering off by mistake. It does not protect your computer from a command you approved. The approval is the real safety step.
Where you meet the sandbox
In a new chat, click "Agent" in the strip above the message box. The dialog "Where should the agent work?" offers "Sandbox" ("Separate folder under ~/agent-workspace/, protected by the file tool path jail."), "Pick a folderā¦" ("Choose a real directory. The agent edits files in there directly, like the Coding Agent.") and, if you used one before, "Use last folder".
While Agent is on, a small badge next to the Agent button names where the agent works: "Sandbox", or the name of the folder you picked. Hover it and it says "Agent working in its own sandbox folder, not in your files. Click to pick a folder." Click it to change the folder. If you close the folder dialog without choosing, the agent works in its sandbox.
Each chat gets its own sandbox folder under ~/agent-workspace (on Windows that is C:\Users\(you)\agent-workspace). It starts empty. Files the agent creates there stay there after the chat; you can open the folder and take them out.
What it does
- The file tools stay in the folder. file_read, file_write, file_edit, file_list and file_search only reach the chat's folder and what is under it. A path that leads outside, with
..or through a symbolic link, is refused. When the agent tries, it gets the answer "The agent can only work with files in this chat's folder. To let it use another place, click the Sandbox or folder button next to Agent, choose "Pick a folderā¦" and select that folder, then ask again." - Only a folder you clicked on counts. A model can make up a path. The app takes a folder as a workspace only if you chose it in its own folder picker, otherwise: "Not an allowed workspace folder (only a folder you chose in LU's folder picker can be a workspace, pick it again to allow it)".
- Some folders are never allowed. A drive root such as
C:\or/, your home folder itself,/Users,/home,/Volumes,/mnt,/mediaand system or credential folders cannot be a workspace, even if you pick them. Pick a project folder instead. - Commands start in the folder. A shell command runs in the chat's folder unless the command names another place, so a relative command such as
npm installdoes not scatter files into your Documents. - A command cannot run forever. A shell command that is still running after two minutes is stopped, together with the programs it started, unless the agent asked for a longer limit.
What it does not do
- No container, no virtual machine. A shell command the agent runs is a real command on your computer, with your user's rights. It can read, change or delete anything your user account can, including files outside the sandbox, if the command says so. The folder rule applies to the file tools, not to the shell.
- No network filter. Commands and the web tools can reach the internet. Nothing between the agent and the network blocks a download or an upload.
- No undo. The sandbox does not keep copies. A file the agent overwrote or deleted is gone unless you have a backup or the folder is under version control such as git.
- Not an isolated environment. The voice settings put it plainly next to their own greyed out "Sandbox" choice: "Not available yet. LU cannot run commands in an isolated environment, so it does not offer one."
What the agent asks before it acts
Every tool belongs to a category with one of three levels under Settings, Agent, Agent Permissions: "Blocked", "Ask First" or "Auto". Out of the box:
| Category | Default | Meaning |
|---|---|---|
| Terminal / Shell | Ask First | Every command waits for you. |
| Filesystem | Ask First | Writing and editing wait for you. Reading, listing and searching inside the chat's own folder do not ask, because they cannot leave it and change nothing. |
| Image Generation, Video Generation, Workflows | Ask First | Wait for you. |
| Desktop Control | Ask First | Screenshots of your screen. |
| Web Access, System Info | Auto | Run without asking. |
When a tool waits, its card in the chat shows the tool and its input with "Approve" and "Reject". Read the input before you approve, above all for shell_execute: that line is exactly what will run on your computer.
Two things to know:
- Background agents do not ask again. When the agent hands part of a task to a sub-agent, the sub-agent follows the same permissions as the chat it came from. It gets nothing you did not allow, and a "Blocked" category stays blocked for it too.
- Auto means auto. The "Tools" button above the message box sets a category to Auto for one chat. With Shell on Auto, commands run without a card. Use that only in a sandbox chat or a folder you can restore.
Computer control, the Beta feature that lets a model click and type in other apps, has its own stricter approval per app and per action and is off by default. On the Mac it is not fully tested yet. It is not part of the sandbox.
Working safely, step by step
For a first task, or anything you are unsure about, choose "Sandbox". Copy the files the agent should work on into that folder rather than giving it your real folder.
When you choose "Pick a folderā¦", the agent edits the files in there directly. Pick the project folder, not a parent folder that holds everything else. A folder under git is ideal: you can see every change and roll it back.
Leave Terminal / Shell on "Ask First" and read each command. Reject anything you do not understand, and ask the agent in the chat what the command does. Reject is always safe: the agent gets told and tries another way.
The stop button on the send button ends the current turn. Sub-agents that already started keep running by design; the "Agents" panel at the side of the chat lists them and stops them. In Cloud mode a running sub-agent keeps using credits, so check that panel after a stop.
The Code tab
The coding agent in the Code tab follows the same folder rule. With no folder picked it works in its own folder under ~/agent-workspace, and its header says "No folder picked. The agent works in (folder)." Its mode menu decides what it asks: "Ask permissions" confirms commands and lets you review edits before they land, "Bypass permissions" runs without asking, and "Plan mode" is read only and writes a plan first. Code-Review Mode, under Settings, Agent, Coding Agent, keeps it read only altogether. See the Code tab chapter.
Common questions
Is the sandbox safe for code I do not trust? No. A command from untrusted code runs on your computer with your rights. The sandbox keeps the file tools in one folder; it is not a place to run something you would not run yourself. For that you need a separate machine or a virtual machine, which the app does not provide.
Can the agent see my documents? Not through its file tools, unless you picked that folder. A shell command could read them if you approve one that names them, so read the command before you approve it.
Where are the files the agent made? In the chat's sandbox folder under ~/agent-workspace, or in the folder you picked. The badge next to "Agent" shows which.
The agent says it cannot open a file I gave it. The file lies outside the chat's folder. Click the badge next to "Agent", choose "Pick a folderā¦" and select the folder that holds the file, or copy the file into the sandbox.
Does Cloud mode change any of this? No. In Cloud mode the model runs on LU Cloud, but the tools still run on your computer, with the same folder rule and the same approvals.
More on the agent: Agent mode. Back to the handbook overview.