Brain and Hands Pattern
The brain and hands pattern separates planning from execution in agentic systems. The language model plans, decides and evaluates results but never executes code itself. Every execution — build steps, tests, scripts, third-party libraries — happens in disposable, network-restricted environments whose output returns only as data.
A security pattern for autonomous agents: the coordinating model ("brain") stays in a protected environment while untrusted code runs only inside isolated virtual machines ("hands").
Explanation
Agents become dangerous when planning and execution share one trust zone. An agent that installs a foreign library and, in the same context, reaches credentials, repository and production systems has no effective boundary left: malicious code or a manipulated file can inject instructions that then run with the agent's privileges. The pattern draws that boundary deliberately. The "brain" holds context, mandate and evaluation logic and has no execution rights. The "hands" are short-lived virtual machines or containers created per task, holding only the minimum credentials required, and discarded afterwards. Their return values are treated as untrusted input, never as commands. In practice this means separate credentials per environment, no standing write access from the execution layer, logging on both sides and a human approval point before results reach production systems.
Marketing Relevance
For technology and marketing organisations the pattern answers how agents can be approved at all. It permits productive autonomy with bounded damage: a compromised execution step costs one discarded machine, not access to CRM, ad accounts or customer data.
Example
An agent is meant to automate a campaign evaluation. Planning happens in the protected context; the script and all installed packages run in a fresh virtual machine with read access to an export area. The result returns as a CSV; write access to the ad account belongs only to a separate, human-approved step.
Common Pitfalls
The most common mistake is half separation: isolated execution but shared credentials or a mounted working directory with write access. Equally risky is feeding execution-layer output back into the model as instruction without review — exactly where prompt injection lands.
Origin & History
Sandboxing is old; applying it to agents is recent. Through 2023 and 2024 coding agents mostly ran directly on developer machines with full privileges. As prompt injection spread via files, issues and dependencies, separating planning from execution took hold from 2025. By 2026 confidential or isolated execution environments are part of the expected setup for production agent fleets.
Marketing Use Cases
Agent execution of third-party code and unknown dependencies.
Automated tests and builds without access to production credentials.
Data analysis on export copies instead of live systems.
Security review of foreign repositories in disposable environments.
Frequently Asked Questions
Is a container enough instead of a virtual machine?
For many cases yes, provided network, filesystem and credentials are consistently restricted. For genuinely unknown code a full virtual machine is the more robust boundary, because it shares less kernel surface with the host.
Does the pattern slow agents down?
It costs startup time per execution step and some setup effort. In exchange you avoid manually reviewing every step up front — overall, agents with clear boundaries usually get approved faster than agents with full privileges.
What still belongs to humans?
Anything outward-facing or hard to reverse: publishing, payments, ad account changes, deletions and permission grants. The pattern bounds damage; it does not replace approval.
Related Services
Go deeper: Agentic AI Hub · Governance & compliance