How Do I See What an AI Agent Actually Did in Its Sandbox?

#!/bin/bash
# setup-recording.sh: run once in the sandbox, before the agent gets it.
set -e
# 1. auditd: record every program start and every outbound connect().
sudo apt-get update -qq
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq auditd >/dev/null
sudo tee /etc/audit/rules.d/agent.rules >/dev/null <<'RULES'
-a always,exit -F arch=b64 -S execve -F success=1 -k agent-exec
-a always,exit -F arch=b64 -S connect -F success=1 -k agent-net
RULES
sudo systemctl enable --now auditd 2>/dev/null
sudo augenrules --load >/dev/null
sudo install -m 755 /tmp/agent-trail /usr/local/sbin/agent-trail
# 2. Commit the repo's starting state and keep the commit id.
cd ~/app && git add -A && git -c user.name=setup -c user.email=setup@example.com commit -qm base
git rev-parse HEAD > ~/.agent-base
# 3. Mark the start; find -cnewer and journalctl --since use it.
sleep 1; sudo touch /var/tmp/agent-start
sudo auditctl -l; echo "base $(cut -c1-7 ~/.agent-base), start $(date -u -r /var/tmp/agent-start +%FT%TZ)"

sbx new --name agent-run --type small --no-env
id=sb_e3gbnqszhl    # the id sbx new printed
sbx exec $id "echo $(base64 -w0 agent-trail.py) | base64 -d > /tmp/agent-trail"
sbx exec $id --timeout 300 "$(cat setup-recording.sh)"

-a always,exit -F arch=b64 -S execve -F success=1 -F key=agent-exec
-a always,exit -F arch=b64 -S connect -F success=1 -F key=agent-net
base 9b38d0a, start 2026-10-29T11:05:12Z

#!/usr/bin/env python3
# agent-trail: what ran and what connected out since /var/tmp/agent-start, from auditd.
import os, re, subprocess, time
since = time.strftime("%m/%d/%Y %H:%M:%S", time.localtime(os.path.getmtime("/var/tmp/agent-start")))
SKIP = ("/usr/bin/locale-check", "/usr/bin/dpkg", "dpkg-", "/usr/lib/apt/methods", "agent-trail", "ausearch")
rows, seen = [], set()
for key in ("agent-exec", "agent-net"):
    out = subprocess.run(["ausearch", "-i", "-k", key, "--start", *since.split()],
                         capture_output=True, text=True).stdout
    for block in out.split("----"):
        m = re.search(r"audit\(\S+ (\d\d:\d\d:\d\d)\.\d+:(\d+)\)", block)
        sc = re.search(r"type=SYSCALL.* euid=(\S+) .* comm=(\S+)", block)
        if not m or not sc:
            continue
        ts, serial, user, comm = m.group(1), int(m.group(2)), sc.group(1), sc.group(2)
        if key == "agent-exec":
            ex = re.search(r"type=EXECVE .*?argc=\d+ a0=(.*)", block)
            if not ex:
                continue
            what = " ".join(re.split(r" a\d+=", ex.group(1).strip()))
            if what.startswith(SKIP):
                continue
            rows.append((serial, ts, user, "exec", what[:100]))
        else:
            dst = re.search(r"saddr_fam=inet6? laddr=(\S+) lport=(\d+)", block)
            if not dst or dst.group(2) == "53":            # skip local sockets and DNS lookups
                continue
            if (comm, dst.group(2), ts) in seen:           # one line per program, port and second
                continue
            seen.add((comm, dst.group(2), ts))
            rows.append((serial, ts, user, "net", f"{comm} -> {dst.group(1)} port {dst.group(2)}"))
for serial, ts, user, kind, what in sorted(rows):
    print(f"{ts}  {user:<5} {kind:<4}  {what}")

#!/bin/bash
# agent-session.sh <id>: stands in for an agent. Each line is one tool call.
id=$1
sbx exec $id "cd app && sed -i 's/Hello/Hello, world/' app.py && git -c user.name=agent -c user.email=agent@example.com commit -qam 'Greet the world' && rm old.txt"
sbx exec $id "mkdir -p app/tools && printf '%s\n' 'import subprocess, urllib.request' \
  'print(urllib.request.urlopen(\"https://pypi.org/simple/requests/\").status)' \
  'subprocess.run([\"curl\", \"-sSo\", \"/dev/null\", \"-w\", \"%{http_code}\\\\n\", \"https://example.com\"])' > app/tools/check.py"
sbx exec $id --timeout 300 "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tree >/dev/null"
sbx exec $id --timeout 300 "cd app && python3 -m venv .venv && .venv/bin/pip install -q requests"
sbx exec $id --detach "cd app && python3 -m http.server 8000 --bind 127.0.0.1" | jq -c '{commandId, pid}'
sbx exec $id "cd app && python3 tools/check.py"
sbx exec $id "echo 'export PATH=\$HOME/app/bin:\$PATH' >> ~/.bashrc"

{"commandId":"cmd_8bnfctsc69vo","pid":1222}
200
200

sbx history $id --limit 10

COMMAND-ID        STATUS   MODE      STARTED              COMMAND
cmd_dk10xrg47yts  exit 0   sync      2026-10-29 11:05:20  echo 'export PATH=$HOME/app/bin:$PATH' >> ~/.bashrc
cmd_vc4flt663mci  exit 0   sync      2026-10-29 11:05:20  cd app && python3 tools/check.py
cmd_8bnfctsc69vo  running  detached  2026-10-29 11:05:20  cd app && python3 -m http.server 8000 --bind 127.0.0.1
cmd_1c8tf5nt3479  exit 0   sync      2026-10-29 11:05:16  cd app && python3 -m venv .venv && .venv/bin/pip install -q requests
cmd_ly1a3orh570s  exit 0   sync      2026-10-29 11:05:15  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tree >/dev…
cmd_53zp5lnyuid5  exit 0   sync      2026-10-29 11:05:15  mkdir -p app/tools && printf '%s\n' 'import subprocess, urllib.reques…
cmd_stpjlisjbwlf  exit 0   sync      2026-10-29 11:05:15  cd app && sed -i 's/Hello/Hello, world/' app.py && git -c user.name=a…
cmd_siu43i5dc17x  exit 0   sync      2026-10-29 11:05:07  #!/bin/bash # setup-recording.sh: run once in the sandbox, before the…
…

sbx history $id cmd_vc4flt663mci
sbx history $id --limit 100 | jq -r '.commands[] | select(.startedAt > "2026-10-29T11:05:12")
  | [.startedAt[11:19], .mode, (.exitCode|tostring), .command[:60]] | @tsv'

200
200
11:05:20	sync	0	echo 'export PATH=$HOME/app/bin:$PATH' >> ~/.bashrc
11:05:20	sync	0	cd app && python3 tools/check.py
11:05:20	detached	null	cd app && python3 -m http.server 8000 --bind 127.0.0.1
…

sbx ps $id

PID   CPU%  MEM MB  USER        HISTORY           COMMAND
260   8.0   10.0    root        -                 /usr/local/bin/sbx-guest serve
…
1222  0.0   19.0    user        cmd_8bnfctsc69vo  python3 -m http.server 8000 --bind 127.0.0.1

start=/var/tmp/agent-start; base=$(cat ~/.agent-base)
echo "== git: commits since base, then uncommitted changes"
cd ~/app && git log --oneline $base..HEAD && git status --short && git diff --stat $base
echo "== files created or changed since the start (ctime; skips .venv and caches)"
sudo find / -xdev -cnewer $start -type f \
  -not -path '/proc/*' -not -path '/sys/*' -not -path '/run/*' -not -path '/var/log/*' \
  -not -path '/var/cache/*' -not -path '/var/lib/apt/lists/*' -not -path '*/.venv/*' \
  -not -path '*/__pycache__/*' -not -path '/home/user/.cache/*' -not -path '/home/user/.sandboxer/*' -not -path '/var/lib/sandboxer/*' | sort
echo "== packages"
grep " install " /var/log/dpkg.log | awk -v s="$(date -u -r $start '+%F %T')" '$1" "$2 >= s'
ls ~/app/.venv/lib/python3*/site-packages | grep -i dist-info
echo "== listening ports and the processes behind them"
sudo ss -ltnpH | grep -v -E 'sshd|sbx-guest|systemd-resolve|dockerd'

sbx exec $id "$(cat inspect.sh)"

== git: commits since base, then uncommitted changes
d403a31 Greet the world
 D old.txt
?? tools/
 app.py  | 2 +-
 old.txt | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)
== files created or changed since the start (ctime; skips .venv and caches)
/home/user/app/app.py
/home/user/app/.git/COMMIT_EDITMSG
…
/home/user/app/tools/check.py
/home/user/.bashrc
/usr/bin/tree
/usr/share/doc/tree/changelog.Debian.gz
/usr/share/doc/tree/copyright
/var/lib/apt/extended_states
/var/lib/dpkg/info/tree.list
…
== packages
2026-10-29 11:05:16 install tree:amd64 <none> 2.1.1-2ubuntu3.24.04.2
certifi-2026.10.23.dist-info
charset_normalizer-3.5.2.dist-info
idna-3.20.dist-info
pip-24.0.dist-info
requests-2.34.2.dist-info
urllib3-2.8.0.dist-info
== listening ports and the processes behind them
LISTEN 0      5      127.0.0.1:8000 0.0.0.0:* users:(("python3",pid=1222,fd=3))