---
type: analysis
slug: a-nearby-proxy-is-useful-only-if-agents-cannot-route-around-it
title: "A nearby proxy is useful only if agents cannot route around it"
description: "Modal’s Sidecars could make trusted proxy and credential logic cheaper to place beside untrusted code. But low-latency adjacency is not proof that every outbound request is mediated; builders need to test bypasses before trusting the boundary."
published_at: 2026-10-02T14:00:00.000Z
topics: ["sandbox"]
source_urls: ["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary","https://blog.cloudflare.com/faster-agent-sandboxes","https://blog.cloudflare.com/emdash-cms-plugin-registry","https://mastra.ai/docs/workspace/sandbox","https://vercel.com/changelog/vercel-sandbox-now-supports-secure-compute","https://blog.cloudflare.com/ai-era-framework"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
# A nearby proxy is useful only if agents cannot route around it

Modal’s Sidecars could make trusted proxy and credential logic cheaper to place beside untrusted code. But low-latency adjacency is not proof that every outbound request is mediated; builders need to test bypasses before trusting the boundary.

## Summary

Modal announced Sidecars, a beta feature for its Sandboxes product: isolated containers alongside a main Sandbox on the same host. The company says teams can use them for trusted services such as credential handling or egress proxying, while agent-generated code stays separately isolated. Modal reports faster Sidecar communication than between separate Sandboxes, but neither those internal measurements nor the Ramp example independently show that outbound traffic cannot bypass the proxy.

## What happened

Modal describes Sidecars as isolated containers connected to the main Sandbox over an internal bridge network, with isolation it says matches separate Sandboxes through gVisor or VMs. Its internal benchmark reports p50 communication latency of 0.58 ms with a Sidecar versus 2.6 ms between separate Sandboxes in the same region, and p99 of 1.4 ms versus 44 ms. Modal also cites Ramp building a custom egress proxy beside its Inspect agent Sandboxes. These are vendor-reported beta details and a customer example, not independent security validation or proof of production performance across workloads.

## What the archive adds

The archive’s Cloudflare Containers and Vercel Secure Compute examples show other ways to put policy around sandbox execution: an external coordinator can govern a workspace, or a sandbox can connect to a dedicated network. An archive practice note says to design agent sandboxes assuming compromise, using controls such as egress allowlists and out-of-band secrets. This context supports the case for a separate enforcement point, but does not establish that Modal’s Sidecars enforce it completely.

## Trend signal

The concrete problem is not simply where to run trusted code; it is whether untrusted code has any route to destinations that bypass that code. A Sidecar placed next to a Sandbox may reduce the communication cost of proxying or handling credentials, as Modal’s own benchmark suggests. Yet the security claim depends on routing and policy configuration, not proximity. The local link and the enforcement guarantee are separate questions.

## Why now

Modal frames the feature as a response to agents combining private-data access, untrusted content, and outbound networking. According to dossier finding d2, its documentation describes Sidecars as separately sandboxed containers on the same host, connected over a low-latency bridge, with uses including trusted harness and proxy logic. The archive’s d1 practice note recommends assuming sandbox compromise and applying controls such as egress allowlists and out-of-band secrets. These pressures make a nearby, separately isolated control point attractive, but they do not prove its policy is unbypassable.

## Connections to other events

Our read is that Sidecars make a trusted proxy easier to colocate with agent execution, not automatically authoritative over it. If every outbound path is forced through the proxy, teams may gain a practical place to apply destination rules and handle credentials without putting that logic in the generated-code container. If some tool or protocol can connect directly, the low bridge latency is beside the point. The July incident note from Modal, cited in dossier finding d3, describes an unauthenticated endpoint accepting internet-submitted code for execution in a Sandbox; it is security context, not evidence that Sidecars would have prevented that incident.

## Why it matters

For builders, the first useful step is a narrowly scoped pilot, not a blanket trust in the new boundary. Route one agent workload through a Sidecar proxy, enumerate its necessary destinations and protocols, then deliberately try to reach an unapproved destination with proxy settings removed or ignored. Check whether non-HTTP traffic is covered and what happens if the proxy fails. Buyers should ask Modal how enforcement and bypass behavior work; a lower-latency path does not answer those questions.

## What happens next

- **Modal’s public Sidecar documentation will clarify at least one operational detail about egress coverage or proxy configuration as beta use develops.** (3 months, 65%). Watch for: A documentation update explains supported traffic types, enforcement configuration, or bypass behavior.
- **A public customer or third-party account will report a workload-specific Sidecar result rather than only bridge-call latency.** (6 months, 45%). Watch for: A published deployment or evaluation reports end-to-end latency and describes how egress enforcement was tested.

## Limits and uncertainty

Modal’s latency figures are internal, and the announcement does not independently establish either isolation strength or complete egress mediation. Ramp’s example demonstrates a use case, not broad production results. The cited July incident involved an unauthenticated endpoint and does not show that Sidecars would prevent similar exposure. Results may also depend on runtime, workload, and network configuration; the available evidence cannot settle those operational details.

## Skill to build now

Build egress threat-testing into sandbox pilots. This week, select one agent task, inventory required destinations and protocols, and try direct connections with proxy settings absent or ignored; verify that an allowlist still blocks unauthorized destinations and note proxy-failure behavior.

## Reader takeaway

This week, take one agent workload and write down every destination and protocol it needs. Test the Sidecar proxy against direct connections, missing or ignored proxy settings, and unauthorized destinations; record both whether the policy holds and end-to-end task latency. Keep production credentials out until the bypass tests pass and you understand the failure behavior.

## Open question

Can Sidecars ensure every outbound path from a real agent workload passes through the intended policy, including traffic from tools that do not honor conventional proxy settings?

## Sources

- [Sidecars: A low-latency trust boundary for Sandboxes](https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary)

- [Cloudflare Containers, rebuilt to scale agent sandboxes | Cloudflare Blog](https://blog.cloudflare.com/faster-agent-sandboxes)

- [EmDash 1.0: the stable CMS with a secure plugin registry | Cloudflare Blog](https://blog.cloudflare.com/emdash-cms-plugin-registry)

- [mastra.ai](https://mastra.ai/docs/workspace/sandbox)

- [Vercel Sandbox now supports Secure Compute - Vercel](https://vercel.com/changelog/vercel-sandbox-now-supports-secure-compute)

- [Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks | Cloudflare Blog](https://blog.cloudflare.com/ai-era-framework)

- [Sandbox Sidecars | Modal Docs](https://modal.com/docs/guide/sandbox-sidecars)

- [A note on the Hugging Face agent incident](https://modal.com/blog/a-note-on-the-hugging-face-agent-incident)

- [Network Limits (Firewall)](https://www.daytona.io/docs/en/network-limits/)

- [Security and privacy at Modal](https://modal.com/docs/guide/security)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json