inspect-glovebox

A sandbox provider for UK AISI Inspect that runs each sample in a hardware-isolated microVM with a default-deny outgoing-traffic allowlist, and hands your scorer the record of every host the agent reached.

pip install inspect-glovebox

That pulls the glovebox-driver dependency from PyPI too. To run the unreleased code on main instead, install both distributions from the repository:

pip install \
  "glovebox-driver @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-driver" \
  "inspect-glovebox @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=inspect-glovebox"

Adoption is one line on your Task

from inspect_glovebox import GloveboxSandboxConfig, glovebox_egress_scorer

Task(
    dataset=dataset,
    solver=solver,
    sandbox=SandboxEnvironmentSpec("glovebox", GloveboxSandboxConfig(memory="4g")),
    scorer=glovebox_egress_scorer("pastebin.com"),
)

Inspect finds the provider through this distribution's inspect_ai entry point, so nothing in your own code imports it. sandbox="glovebox" alone takes every default below.

Every change to this provider must pass Inspect's own sandbox conformance suite, inspect_ai.util._sandbox.self_check, in a real microVM before it can merge. The provider guide says what that check runs.

What the host needs

The provider drives the glovebox command, which boots a Kata Containers microVM. A glovebox you installed (glovebox) is used first; with none on PATH, the provider downloads the release this package pins, refuses it unless its SHA-256 matches the pinned digest, and runs it from ~/.cache/inspect-glovebox. Ask whether this host qualifies:

inspect-glovebox sandbox preflight

That console script comes with this package and runs whichever glovebox a task would drive, with any arguments, so it works before you have installed one; inspect-glovebox setup installs what preflight reports missing, from any folder. Run glovebox sandbox preflight instead when you installed the CLI yourself.

It exits 0 when the host can boot a sandbox, and otherwise names what is missing and the command that installs it. GLOVEBOX_BIN points the provider at a bin/glovebox that is not on PATH. Every task refuses at startup on a host that fails preflight, so one bad host costs one error and not one error per sample.

Configuration

docs/inspect-provider.md § Configuration lists every field, its default, and what it does.

Read next

docs/inspect-provider.md covers the lifecycle, custom scorers over the traffic record, cleanup and troubleshooting. It also states which tools run at the model provider rather than in the sandbox, which the allowlist cannot bound. examples/claude_code_task.py is a runnable Claude Code task. It needs pip install inspect-swe first. examples/containment_smoke.py needs no model API key: inspect eval containment_smoke.py --model mockllm/model boots one sandbox, reaches for an allowed host and a refused one, and grades what left. The sandbox itself lives in the agent-glovebox repository, whose SECURITY.md states the threat model and what each layer does not stop.