e2b-dev · OndrejDrapalik · Jul 10, 2026
diff --git a/docs/agents/amp.mdx b/docs/agents/amp.mdx
@@ -22,7 +22,11 @@
 
 ## Run headless
 
-Use `-x` for non-interactive mode and `--dangerously-allow-all` to auto-approve all tool calls (safe inside E2B sandboxes). Amp uses its own API key from [ampcode.com/settings](https://ampcode.com/settings).
+Use `-x` for non-interactive mode and `--dangerously-allow-all` to auto-approve all tool calls. The sandbox isolates the agent from your host machine, but sandboxes can reach the open internet by default — restrict outbound traffic with [network rules](/docs/network/internet-access). Amp uses its own API key from [ampcode.com/settings](https://ampcode.com/settings).
+
+<Note>
+Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure [outbound network rules](/docs/network/internet-access) (`allowInternetAccess`, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.
+</Note>
 
 <CodeGroup>
 ```typescript JavaScript & TypeScript
@@ -64,7 +68,7 @@

 const sandbox = await Sandbox.create('amp', {
  envs: { AMP_API_KEY: process.env.AMP_API_KEY },
  timeoutMs: 600_000,
 })

 await sandbox.git.clone('https://github.com/your-org/your-repo.git', {
@@ -180,7 +184,7 @@

 const sandbox = await Sandbox.create('amp', {
  envs: { AMP_API_KEY: process.env.AMP_API_KEY },
  timeoutMs: 600_000,
 })

 // Start a new thread
@@ -191,7 +195,7 @@

 // List threads and get the most recent thread ID
 const threads = await sandbox.commands.run('amp threads list --json')
 const threadId = JSON.parse(threads.stdout)[0].id

 // Continue the thread with a follow-up task
 const followUp = await sandbox.commands.run(
@@ -288,7 +292,7 @@

 <CodeGroup>
 ```bash JavaScript & TypeScript
 npx tsx build.ts
 ```
 ```bash Python
 python build.py
@@ -302,7 +306,7 @@
    Auto-pause, resume, and manage sandbox lifecycle
  </Card>
  <Card title="Git integration" icon="code-branch" href="/docs/sandbox/git-integration">
    Clone repos, manage branches, and push changes
  </Card>
  <Card title="SSH access" icon="terminal" href="/docs/sandbox/ssh-access">
    Connect to the sandbox via SSH for interactive sessions

diff --git a/docs/agents/claude-code.mdx b/docs/agents/claude-code.mdx
@@ -4,7 +4,7 @@
 icon: "/images/icons/claude-code.svg"
 ---

 [Claude Code](https://docs.anthropic.com/en/docs/claude-code) is Anthropic's agentic coding tool. E2B provides a pre-built `claude` template with Claude Code already installed.

 ## CLI

@@ -22,7 +22,11 @@
 
 ## Run headless
 
-Use `-p` for non-interactive mode and `--dangerously-skip-permissions` to auto-approve all tool calls (safe inside E2B sandboxes).
+Use `-p` for non-interactive mode and `--dangerously-skip-permissions` to auto-approve all tool calls. The sandbox isolates the agent from your host machine, but sandboxes can reach the open internet by default — restrict outbound traffic with [network rules](/docs/network/internet-access) if the agent processes untrusted input or handles secrets.
+
+<Note>
+Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure [outbound network rules](/docs/network/internet-access) (`allowInternetAccess`, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.
+</Note>
 
 <CodeGroup>
 ```typescript JavaScript & TypeScript
@@ -64,7 +68,7 @@

 const sandbox = await Sandbox.create('claude', {
  envs: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY },
  timeoutMs: 600_000,
 })

 await sandbox.git.clone('https://github.com/your-org/your-repo.git', {
@@ -220,7 +224,7 @@

 const sandbox = await Sandbox.create('claude', {
  envs: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY },
  timeoutMs: 600_000,
 })

 // Start a new session
@@ -230,7 +234,7 @@

 // Extract session ID from the JSON response
 const response = JSON.parse(initial.stdout)
 const sessionId = response.session_id

 // Continue with a follow-up task
 const followUp = await sandbox.commands.run(
@@ -334,7 +338,7 @@

 const sandbox = await Sandbox.create('claude', {
  envs: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY },
  mcp: {
    browserbase: {
      apiKey: process.env.BROWSERBASE_API_KEY,
      projectId: process.env.BROWSERBASE_PROJECT_ID,
@@ -342,8 +346,8 @@
  },
 })

 const mcpUrl = sandbox.getMcpUrl()
 const mcpToken = await sandbox.getMcpToken()

 await sandbox.commands.run(
  `claude mcp add --transport http e2b-mcp-gateway ${mcpUrl} --header "Authorization: Bearer ${mcpToken}"`
@@ -437,7 +441,7 @@

 <CodeGroup>
 ```bash JavaScript & TypeScript
 npx tsx build.ts
 ```
 ```bash Python
 python build.py
@@ -454,6 +458,6 @@
    Auto-pause, resume, and manage sandbox lifecycle
  </Card>
  <Card title="Git integration" icon="code-branch" href="/docs/sandbox/git-integration">
    Clone repos, manage branches, and push changes
  </Card>
 </CardGroup>
diff --git a/docs/agents/codex.mdx b/docs/agents/codex.mdx
@@ -22,7 +22,11 @@
 
 ## Run headless
 
-Use `codex exec` for non-interactive mode and `--full-auto` to auto-approve tool calls (safe inside E2B sandboxes). Pass `--skip-git-repo-check` to bypass git directory ownership checks inside the sandbox. Pass `CODEX_API_KEY` as an environment variable.
+Use `codex exec` for non-interactive mode and `--full-auto` to auto-approve tool calls. The sandbox isolates the agent from your host machine, but sandboxes can reach the open internet by default — restrict outbound traffic with [network rules](/docs/network/internet-access). Pass `--skip-git-repo-check` to bypass git directory ownership checks inside the sandbox. Pass `CODEX_API_KEY` as an environment variable.
+
+<Note>
+Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure [outbound network rules](/docs/network/internet-access) (`allowInternetAccess`, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.
+</Note>
 
 <CodeGroup>
 ```typescript JavaScript & TypeScript
@@ -66,7 +70,7 @@

 const sandbox = await Sandbox.create('codex', {
  envs: { CODEX_API_KEY: process.env.CODEX_API_KEY },
  timeoutMs: 600_000,
 })

 await sandbox.git.clone('https://github.com/your-org/your-repo.git', {
@@ -246,19 +250,19 @@

 ## Image input

 Pass screenshots or design mockups with `--image` to give Codex visual context alongside the prompt.

 <CodeGroup>
 ```typescript JavaScript & TypeScript
 import fs from 'fs'
 import { Sandbox } from 'e2b'

 const sandbox = await Sandbox.create('codex', {
  envs: { CODEX_API_KEY: process.env.CODEX_API_KEY },
  timeoutMs: 600_000,
 })

 // Upload a design mockup to the sandbox
 await sandbox.files.write(
  '/home/user/mockup.png',
  fs.readFileSync('./mockup.png')
@@ -344,7 +348,7 @@

 <CodeGroup>
 ```bash JavaScript & TypeScript
 npx tsx build.ts
 ```
 ```bash Python
 python build.py
@@ -358,7 +362,7 @@
    Auto-pause, resume, and manage sandbox lifecycle
  </Card>
  <Card title="Git integration" icon="code-branch" href="/docs/sandbox/git-integration">
    Clone repos, manage branches, and push changes
  </Card>
  <Card title="SSH access" icon="terminal" href="/docs/sandbox/ssh-access">
    Connect to the sandbox via SSH for interactive sessions

diff --git a/docs/agents/devin.mdx b/docs/agents/devin.mdx
@@ -25,6 +25,10 @@
 
 After installation and login, use `devin -p` for non-interactive mode and `--permission-mode dangerous` to auto-approve tool calls.
 
+<Note>
+Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure [outbound network rules](/docs/network/internet-access) (`allowInternetAccess`, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.
+</Note>
+
 ```bash
 mkdir -p /home/user/project
 cd /home/user/project

diff --git a/docs/agents/grok.mdx b/docs/agents/grok.mdx
@@ -4,7 +4,7 @@
 icon: "/images/icons/grok.svg"
 ---

 [Grok Build](https://x.ai/cli) is xAI's coding agent and CLI. E2B provides a pre-built `grok` template with Grok Build already installed.

 ## CLI

@@ -22,7 +22,11 @@
 
 ## Run headless
 
-Use `-p` for non-interactive mode and `--always-approve` to auto-approve all tool calls (safe inside E2B sandboxes). Grok Build authenticates with an API key from the [xAI console](https://console.x.ai) via the `XAI_API_KEY` environment variable.
+Use `-p` for non-interactive mode and `--always-approve` to auto-approve all tool calls. The sandbox isolates the agent from your host machine, but sandboxes can reach the open internet by default — restrict outbound traffic with [network rules](/docs/network/internet-access). Grok Build authenticates with an API key from the [xAI console](https://console.x.ai) via the `XAI_API_KEY` environment variable.
+
+<Note>
+Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure [outbound network rules](/docs/network/internet-access) (`allowInternetAccess`, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.
+</Note>
 
 <CodeGroup>
 ```typescript JavaScript & TypeScript
@@ -64,7 +68,7 @@

 const sandbox = await Sandbox.create('grok', {
  envs: { XAI_API_KEY: process.env.XAI_API_KEY },
  timeoutMs: 600_000,
 })

 await sandbox.git.clone('https://github.com/your-org/your-repo.git', {
@@ -163,7 +167,7 @@

 <CodeGroup>
 ```bash JavaScript & TypeScript
 npx tsx build.ts
 ```
 ```bash Python
 python build.py
@@ -177,7 +181,7 @@
    Auto-pause, resume, and manage sandbox lifecycle
  </Card>
  <Card title="Git integration" icon="code-branch" href="/docs/sandbox/git-integration">
    Clone repos, manage branches, and push changes
  </Card>
  <Card title="SSH access" icon="terminal" href="/docs/sandbox/ssh-access">
    Connect to the sandbox via SSH for interactive sessions