A sandbox can name the secrets it gets

Create a sandbox with secrets: ["ANTHROPIC_API_KEY"] (runtime sandboxes create --secret ANTHROPIC_API_KEY) and it gets only that egress secret: no placeholder for any other, and our proxy puts no other value into its requests. An agent given untrusted input can no longer send a key meant for other work. [] is none; the list narrows each secret's own only, is fixed for the sandbox's life, and a fork or copy of a snapshot may only narrow it. In the API, the MCP tool and every SDK. See secrets sandboxes never see.