Safety & Security · Software component

Sandbox Anomaly Detector

Software componentSafety & SecuritySafety, Security & Governancearc:SandboxAnomalyDetector

A monitoring component that continuously observes sandboxed agent behavior and flags anomalous resource consumption, unexpected network connections, suspicious file access or repeated policy violations.

Responsibility. Detects signs of compromise or misuse inside sandboxes.

Also known as: Monitoring and response layer (detection)

Direct neighbourhood (hover for relationship types)

Relationships

receives telemetry from dynamic

Runtime Security Policy Enforcer Ch9.3

triggers dynamic

Automated Containment Responder Ch9.3

monitors assurance

Execution Sandbox abstract Ch9.3

Quantitative guidance

As stated by the sources; verify before use.

Exfiltration attempts should trigger alerts within seconds (Ch9.3).

Classification

Risks mitigated: Sophisticated attacks that evade other layersOngoing data exfiltration

Sources

Ch9.3: T. Nguyen, "Sandboxing and Transparency Foundations," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.3. ISBN: 9798244538229.