Pydantic AI 2.60.0 Adds Local Container and Micro-VM Sandboxes to Strengthen Agent Isolation

Pydantic AI 2.60.0 was released to PyPI on October 23, adding two Harness capabilities that let agents work with files and run commands in isolated local environments: DockerSandbox and BoxLiteSandbox. Although the GitHub release title is dated October 22, both the actual release time and the package listing record fall on the 23rd. Package record

DockerSandbox uses the existing Docker CLI and works with Docker or Podman to run Coder’s shell and file tools inside a container. A workspace is created on first use; later, the same container can be resumed through conversation history or a workspace reference, preserving generated files. However, the container uses bridge networking by default and can reach the internet and local network services. To disable network access, explicitly set allow_internet_access=False. Deployers also determine which parts of the project directory are mounted. Docker sandbox documentation

BoxLiteSandbox runs tools in a micro-virtual machine with its own kernel and filesystem, without requiring a cloud account. It has no network access by default; after enabling connections, destinations can be restricted with allowed_hosts. The official documentation currently lists support for Apple Silicon macOS and Linux. On Linux, the runner needs access to /dev/kvm. For engineering teams, this provides an execution boundary beyond containers, though the choice still depends on the host platform and network requirements. BoxLite documentation

The release also strengthens the trust boundary around model inputs: sanitize_messages removes request-level instructions from untrusted history, while background output from subagents is now presented as data inside <task_output> rather than placed in the system prompt field. These changes address how agents receive history and tool data; they should not be treated as a comprehensive solution to prompt injection. 2.60.0 release notes

Upgrade validation should cover workspace resumption, mount permissions, and network restrictions. The maintainers warn that Harness is still in the 0.x stage and its API may change in minor versions. As of this review, version 2.61.0 had also been released with further guardrail fixes, so teams adopting the feature should read the subsequent release notes as well. 2.61.0 release notes