Containment

A computer program that derives its own rules from data is called an AI system. Today, such systems can not only write texts but also execute commands on a computer, modify files, or send messages. Containment means: one builds an environment in which the system can actually do only a narrow, predetermined part of all this. Everything else is not forbidden but made technically impossible. The comparison with a laboratory for dangerous viruses fits well. There, one does not rely on caution but on sealed doors, filters, and separate air circuits.

Why one does not simply trust the system

Modern AI models are not programmed line by line. They have emerged from vast amounts of data, and no one can fully predict how they will react in a new situation. That is exactly the problem: one can test a behavior but cannot prove that it will remain that way in every case. Containment is the answer to this uncertainty.

Experts therefore distinguish two approaches. One tries to teach the system the right goals so that it does nothing harmful of its own accord. The other limits its possibilities from the outside. The first approach is the more elegant one, the second the more reliable one. In practice, both are combined, because neither alone is sufficient.

What matters is the practical everyday case, not just the catastrophic scenario. An AI assistant that accidentally deletes a database causes real damage without having any malicious intent. Errors, misunderstandings, and manipulated user inputs also count here. Containment protects against all these cases simultaneously, because it does not ask about motive.

Sandbox, permissions, and kill switch

The most common tool is the sandbox. This is an isolated area on a server in which the system may compute without touching the rest of the computer. There, it only sees the files it is given. If something crashes or is destroyed, it only affects this area.

In addition, there are narrowly set permissions. A system that is only supposed to read gets no write permission. A system that checks invoices gets no access to the payment transfer system. Internet access is also often blocked or restricted to a few permitted addresses. In computer science, this principle is called the principle of least privilege: everyone gets exactly as much as they need for their task.

A third layer is monitoring and abort mechanisms. All actions are logged so that one can later reconstruct what happened. Sensitive steps such as payments or deleting data require human confirmation. And there is a kill switch that stops the system immediately. That sounds trivial, but it is hard to build cleanly when hundreds of processes are running in parallel.

Containment in products and in regulation

Anyone who uses an AI for programming sees containment directly. The code runs in an isolated environment, and before every access to real files, the program asks for confirmation. AI agents that shop or book appointments in the browser work similarly: they may click, but the final confirmation step usually remains with the human.

In news reports, the term often appears in its English original as containment. Major AI labs publish safety policies in which they classify models by risk level. From a certain level onward, the lab promises additional containment measures, such as stricter access controls to the model weights. Authorities, too, specifically ask about such protective layers during review procedures.

A common misconception is that containment is the same as censorship or a content filter. A filter blocks certain answers, such as instructions for explosives. Containment, by contrast, limits the system’s ability to act in the world, regardless of what it says. Both exist in parallel and solve different problems.