How Cloud-Based Agent Sandboxing Works in Air - The JetBrains Blog

JetBrains Air’s cloud agents allow developers to run AI coding tasks remotely in managed, isolated environments rather than on local machines, with organizational availability currently offered through Air IDE integrations and Air Teams. The discussion emphasizes sandboxing as a means of limiting an agent’s access to files, networks, APIs, secrets, and system resources, reducing risks such as unintended changes, data exposure, and malicious prompt-driven behavior. It compares local workspaces and Git worktrees, which can share aspects of a developer’s machine, with remote SSH, Docker, Docker Sandboxes, and cloud execution, which provide progressively stronger isolation but differ in required setup and administration. In Air, each task receives a new cloud VM containing a Docker container, with all agent network traffic routed through a proxy that can restrict connections to trusted source-control and package-registry domains, permit selected additional domains, allow all internet access, or disable it entirely. Secrets are encrypted and supplied as environment variables without exposing shared values to teammates, while repository access remains limited to the initiating developer’s existing permissions.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.