TopolearnThe sandbox is how agents analyse data and call systems without connectors, and secrets must be handled carefully there.
Each agent conversation gets its own sandbox: a private, temporary cloud computer. The agent can write and run small programs (mostly in Python, a popular programming language) and shell commands (typed instructions to the computer), read and write files, and move files between Gumloop and the sandbox. That's how it analyses a spreadsheet, makes a chart, or converts a PDF, even if you never write code yourself.
What to know:
- Files saved in the working folder stay with that conversation; other conversations can't see them.
- There is a shared team workspace folder and a private personal one.
- Many common data and file-processing packages (ready-made code libraries) are preinstalled.
- It has internet access, but it's not meant for permanent servers or very long jobs.
To call a system that has no connector, the agent's code may need an API key. Never paste keys into the chat. Store them as secrets in the Vault (this page was called Secrets until 2026), personal or team-level. Then add the secret to the agent under a name like PYLON_API_KEY. The agent's code reads it at run time; the value is not put into the conversation.
Secrets can be bound as personal, team, or agent-owned (everyone who uses the agent runs with it, without seeing it; this needs admin permission and can't be combined with public sharing).
Gumloop's docs are honest about the limit: code that can use a secret could also leak it. Bind only the secrets an agent needs, and never ask an agent to print or export one.
Remember
- Each task has a private sandbox for code and files
- Store API keys in the Vault and attach them to agents by name
- Bind only needed secrets; code that uses a secret could expose it
Watch out for
- Pasting an API key into a chat message, where it stays in the task history.