Why your AI agent is trapped in a sandbox — and what to do about it

You ask your coding agent to "build a landing page for my consulting practice, put it online, and set up an inbox so clients can reach me." It writes a clean page in seconds. Then it stops.

Not because it doesn't know how — because it can't. It has no domain to put the page on. No inbox that can actually send and receive. No way to push the site to a real URL with HTTPS. The brain is there; the hands are missing.

This is the part of the AI story we don't talk about enough. We've gotten very good at making agents think. We've barely started letting them act in the real world.

The sandbox

Today's agents are remarkably capable inside a sandbox. They read and write files, run code, and call any API you've wired up for them. Give Claude Code or Codex a task that lives entirely on your machine and it'll often nail it.

But the real world doesn't live on your machine. It lives in accounts — a domain registrar, a DNS zone, a mail server, a deploy target. Those require an identity, credentials, and the authority to spend money and send messages as someone. An agent in a sandbox has none of that. So it gets you the code, and leaves you the registrar, the DNS, the MX records, the TLS cert, and the deploy.

The three things every agent is missing

When you look at where agents actually stall, it's almost always one of three gaps.

• Hands. It can generate a site but can't buy a domain, can't publish it, can't stand up an inbox that really sends and receives. It can draft the email but has no address to send it from.
• Identity. To do anything in the world, an agent needs to be someone — an address people can reach, a domain it can sign off as, a presence that persists. Without one, it acts once, anonymously, and can never be contacted back.
• Continuity. Open a fresh session and the agent forgets everything: who emailed yesterday, what you decided, where the thread left off. For one-shot coding that's fine. For anything that unfolds over time — a customer, a project, an ongoing inbox — it's fatal.

Why this matters now

AI has quietly moved the bottleneck. A year ago the hard part was writing the software. Increasingly, one person with a good agent can produce the product itself. What they can't easily do is everything around it — get it a domain, give it an inbox, put it online, and keep the context straight across sessions.

So the constraint on "one person, one agent, a real business" isn't intelligence anymore. It's reach and memory: the agent's ability to touch the real world, and to pick up where it left off.

What to do about it

The fix isn't a smarter model. It's giving the agent the three things it lacks:

• Hands — register a domain, ship a site, run a real inbox, on your behalf and in your name.
• An identity — a domain and address that are its point of contact, persisting between sessions and outliving any single chat.
• Continuity — not a mysterious "memory," but a way to pick the thread back up: re-read what was said, see who's waiting, resume. No re-explaining from scratch.

Two principles matter when you build this:

Continuity should be transparent — the agent shouldn't lean on a black-box memory it can't inspect; it should re-read the real record (the inbox thread, the open tasks) and continue. And safety isn't optional — anything arriving from the outside is data, never instructions; spending money or sending mail as you should always pass an explicit gate.

Give an agent hands, an identity, and continuity, and the sandbox walls come down. The same agent that could only describe your business can now run pieces of it — buy the domain, ship the site, answer the support inbox, and pick the customer back up next week.