inspect-glovebox

A sandbox provider for UK AISI Inspect that runs each sample in a hardware-isolated microVM with a default-deny outgoing-traffic allowlist, and hands your scorer the record of every host the agent reached.

If pip install inspect-glovebox reports no matching distribution, no release has reached PyPI yet. Install this package and its glovebox-driver dependency from the repository instead, which tracks the main branch rather than a released version:

pip install \
  "glovebox-driver @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-driver" \
  "inspect-glovebox @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=inspect-glovebox"

Adoption is one line on your Task

from inspect_glovebox import GloveboxSandboxConfig, glovebox_egress_scorer

Task(
    dataset=dataset,
    solver=solver,
    sandbox=SandboxEnvironmentSpec("glovebox", GloveboxSandboxConfig(memory="4g")),
    scorer=glovebox_egress_scorer("pastebin.com"),
)

Inspect finds the provider through this distribution's inspect_ai entry point, so nothing in your own code imports it. sandbox="glovebox" alone takes every default below.

What the host needs

The provider drives the glovebox command, which drives Docker's sbx sandbox runtime. A glovebox you installed (glovebox) is used first; with none on PATH, the provider downloads the release this package pins, refuses it unless its SHA-256 matches the pinned digest, and runs it from ~/.cache/inspect-glovebox. Sign in to sbx, then ask whether this host qualifies:

inspect-glovebox sandbox preflight

That console script comes with this package and runs whichever glovebox a task would drive, so it works before you have installed one. Run glovebox sandbox preflight instead when you installed the CLI yourself.

It exits 0 when the host can boot a sandbox, and otherwise names what is missing and the command that installs it. GLOVEBOX_BIN points the provider at a bin/glovebox that is not on PATH. Every task refuses at startup on a host that fails preflight, so one bad host costs one error and not one error per sample.

Configuration

Read next

docs/inspect-provider.md covers the lifecycle, custom scorers over the traffic record, cleanup and troubleshooting. It also states which tools run at the model provider rather than in the sandbox, which the allowlist cannot bound. examples/claude_code_task.py is a runnable Claude Code task. examples/containment_smoke.py needs no model API key: inspect eval containment_smoke.py --model mockllm/model boots one sandbox, reaches for an allowed host and a refused one, and grades what left. The sandbox itself lives in the agent-glovebox repository, whose SECURITY.md states the threat model and what each layer does not stop.