Kobel vs. sandbox and VM
“Just run the AI in a VM” is good advice — for the case where the AI never has to touch anything real. The moment it does, the problem simply moves one step along.
Last verified:
Isolation protects by absence. Inside a sandbox or a VM the AI cannot see your files because they are not there. That works as long as the task can be done without them — trying out unknown software, for instance.
But most of the tasks people let an AI near their computer for need exactly those real files: proposals, invoices, contracts, photos, source code. So you hand a folder in. Microsoft's own documentation warns explicitly about what applies from then on: “Files and folders mapped from the host can be compromised by apps in the sandbox or potentially affect the host. Changes made during a Sandbox session to a mapped folder with write-permissions will persist after a Sandbox is disposed.” At that point it is no longer isolation that protects you but the permission on the mapping — and that has exactly two values.
Two mechanisms that get confused
Isolation
AI → isolated environment → copies, no real data
- Question: can this process reach the machine at all?
- Examples: Windows Sandbox, Hyper-V, VMs, containers
- Strength: a malicious process stays inside
- Limit: ends at the first mapped folder
- Side effect: state is lost, software is missing
Permission
AI → Kobel → real folders, graded
- Question: what may happen to this resource?
- Examples: allowed directories,
romounts, Kobel's five levels - Strength: work on real files stays possible
- Limit: no protection against malicious code
- Side effect: none — your working day stays your working day
The two are not mutually exclusive. They answer different questions, and most people need the second one while believing they asked the first.
What a sandbox costs you day to day
Windows Sandbox is a good tool for what it was built for. Three of its properties stand in the way of sustained AI work, and all three are stated in Microsoft's documentation:
- It is ephemeral. “The sandbox is temporary; closing it deletes all software, files, and state. Each launch provides a fresh instance.” The AI client would have to be reinstalled and reconnected every session.
- Installed software is missing. “Host-installed software isn't available in the sandbox.”
- It is not available everywhere. “Windows Sandbox is currently not supported on Windows Home edition.” Add virtualization enabled in the BIOS, at least 4 GB of RAM (8 recommended), two cores (four recommended) and 1 GB of free disk space. Running several instances at once is not supported.
And WSL is not a boundary for this purpose: the Windows C: drive sits under /mnt/c, and Windows binaries
run as the active Windows user with the same permission rights as the WSL process.
Feature comparison
| Sandbox / VM | Kobel | |
|---|---|---|
| Core principle | Isolation | Graded permission |
| Work on real files | Only through mapped folders | Yes, directly |
| Rights per folder | Two: readable or writable (ReadOnly, default: writable) | Five levels |
| Write with backup | No | Yes |
| State survives | Windows Sandbox: no | Yes |
| AI client must be set up again | Every session (sandbox) | No |
| Activity log of AI actions | No | Yes, timestamped |
| Protects against malicious code | Yes, that is its purpose | No |
| Requirements | Windows Pro/Enterprise/Education, virtualization, 4 GB RAM and up | Windows 10/11 or macOS |
| Setup | Write a .wsb file or build and maintain a VM | Drag a folder in, pick a colour |
| Covers apps and accounts too | No | Yes |
| Cost | Included in Windows | Free tier; €49 once or €3.90/month |
If you want to try an unknown MCP server, a stranger's script or software from a doubtful source, isolation is not merely sufficient, it is correct — and Kobel is the wrong tool for it. Kobel governs access rights; it does not contain processes. If you need both, do both: the foreign process into the container, your own folders behind the permission layer.
When each one fits
Sandbox or VM, if …
- You are testing unknown software or scripts
- The task can be done without your real data
- A process must be kept away from the system
- You run Windows Pro, Enterprise or Education
- Setting it up each session does not bother you
Kobel, if …
- The AI should work on your real files
- Different folders need different rights
- Nothing should be rebuilt every session
- You need to show what the AI did
- You are on Windows Home
Kobel's five permission levels
Every folder, app and account carries exactly one of these five levels. You set it by dragging a folder in and picking a colour — no configuration file.
- GreenRead and write. The AI may open files and save changes directly.
- TealWrite with an automatic backup. A copy is made before every change, so a bad edit can always be undone.
- OrangeRead the original, write only to copies. The AI can work with the data but cannot alter the source file.
- YellowRead only. Look, don't touch.
- RedBlocked. The resource is invisible to the AI.
Keep reading
Sources
- Microsoft – Windows Sandbox overview (ephemeral, no host software)
- Microsoft – requirements (not supported on Windows Home, RAM, cores, virtualization)
- Microsoft –
.wsbconfiguration,MappedFolders,ReadOnlyand the mapped-folder warning - Microsoft – WSL and Windows file systems (
/mnt/c, permissions, recommendation) - Docker – MCP Toolkit (containers as a variant of the same approach)
Try it with one folder
Install Kobel, drag in a single folder, set it to read-only, connect your AI. Two minutes. Free tier, no account needed.
Download KobelSee the featuresFrequently asked questions
Can I just run my AI inside a sandbox?
Technically yes, in practice rarely as a permanent setup. Windows Sandbox is explicitly ephemeral: Microsoft states that closing it deletes all software, files and state, and that each launch provides a fresh instance. Software installed on the host is not available inside the sandbox. You would have to set up and reconnect the AI client for every session, and your working files would still be outside it.
Why isn't isolation enough?
Because isolation protects by absence: your real files simply are not there. The moment you want to work on them you map a folder in, and Microsoft warns about exactly that in writing: files and folders mapped from the host can be compromised by apps in the sandbox or potentially affect the host, and changes made to a mapped folder with write permissions persist after the sandbox is disposed. From that point on, what protects you is the permission on the mapping, not the isolation.
Does Windows Sandbox run on every machine?
No. Microsoft states that Windows Sandbox is currently not supported on Windows Home edition. Pro, Enterprise, Education and Pro Education are supported. It also requires virtualization enabled in the BIOS, at least 4 GB of RAM (8 GB recommended), at least two CPU cores (four with hyper-threading recommended) and at least 1 GB of free disk space.
Can I map a folder into the sandbox as read-only?
Yes, through a .wsb configuration file using the ReadOnly element inside MappedFolders. Note the default: it is false, meaning writable. If you do not write that file yourself and set the value explicitly, the folder goes in with write permissions.
Is Kobel a sandbox?
No, and the two should not be confused. Kobel does not isolate processes and does not replace containers. Kobel sits as a permission layer between the AI and the device's real folders, apps and accounts, and decides per resource what is allowed. If you want to try an unknown and possibly malicious server process, use a container or a VM for that.
What about WSL?
WSL is not a security boundary for this purpose. The Windows C: drive is reachable inside WSL under /mnt/c, and Windows binaries run as the active Windows user with the same permission rights as the WSL process. Microsoft also advises against working across the operating system boundary at file level for performance reasons.