|
|
|
01 / these logins
| |
02 / your network
| |
03 / these files
|
|
|
Agent sandboxes / Tailscale Tunnels
Give every agent its own sandbox.
An AI agent turns dangerous when it holds three things at once: your private data, untrusted content, and a way to send data out. Simon Willison calls it the lethal trifecta. A browser agent reads untrusted pages all day, so the fix is to limit the other two. A Retriever sandbox scopes each agent to the logins its job needs, sends its traffic out through a network you control, and hands it the files for that job.
▶ Play video
Why agents get flagged. A session that moves from your laptop to a data center looks like a new device. Tailscale Tunnels send a Cloud agent's traffic out through a computer on your own network, so sites see your office or home IP.
|
|
How a sandbox breaks the trifecta
Limit what the agent can see, and where it can send.
| 01 |
Only the logins you pick.
Choose which sites' logins Cloud can use, and keep separate login profiles, for example one per job or client. Each run or schedule uses one profile's logins, or none. Saved passwords are typed in by our sign-in code; the AI model never receives them, only the site and a masked username.
|
| 02 |
Your network, your firewall.
A Tailscale Tunnel sends a Cloud agent's traffic out through a computer on your network, so sites see your IP and your network's firewall applies. Our egress gateway refuses requests to private addresses such as your router; the post explains the one DNS gap we are still closing.
|
| 03 |
The files for the job.
Attach the files, datasets, a recording or skills a job needs to its run or schedule. Scheduled agents keep their own memory between runs. Each run has its own cloud browser, and when it ends, its tabs close and its site data is cleared.
|
|
No sandbox makes a hostile page harmless. The point is to shrink what a tricked agent holds.
|
|
For teams
One sandbox per job, not one agent with every key.
Most teams start with one agent signed in to everything. Split it instead. Give each job its own login profile and files, put it on a schedule, and let it run in the cloud while your team works.
| Agent | Its profile and files | Not in its profile | | Prospecting | LinkedIn and your CRM, a lead sheet | Billing, payroll, the help desk | | Finance | The billing portal, an invoices sheet, your office IP | LinkedIn, the CRM | | Support | The help desk, your product docs | Billing, the CRM |
If one agent reads a poisoned page, it holds only its own profile's logins, not every account your team uses.
|
|
Free vs. paid
Free Mode for everyone. More with any plan.
Retriever AI stays free. Free Mode runs your tasks at zero credits, paid for by a small sponsored card, within a daily fair-use allowance. Any paid plan now upgrades Free Mode itself:
| Free plan | Any paid plan | | Ad breaks | Long tasks pause now and then for a short ad break. | None. Long tasks keep going. | | Models | Value models such as GPT-6 Luna, GLM 5.3 Flash and DeepSeek V4 Flash. | The same value models. Premium models such as GPT-6.1 Terra and DeepSeek V4 Pro run on credits. | | Reasoning | Off or Low (up to Medium on GPT-6 Luna). | Every level. | | Schedules | One schedule, once a day. | As many as you need, as often as every few minutes. On a value model each uses the daily allowance first, then your credits. On a premium model, or if you tell the agent “use my credits for this one”, it runs on credits with no ads. |
More reasoning uses more of the daily allowance. Turn Free Mode off whenever you like and runs bill your plan's credits, on any model, with no sponsored card at all.
|
|
One agent, every way in
Search, Fetch, Datasets and Map, together.
Most data jobs mix four moves: find the sources, list what a site has, read the pages, and fill in the records. We are putting all four in one agent, used together in the same run, with a real browser for the pages that need a sign-in or a click.
|
Live
Search
Search the web from inside a task, then read and compare the results like any other step.
|
|
Live
Datasets
Fill in people and companies from LinkedIn, Crunchbase, Google Maps and more. Your first 1,000 records and searches each month are free.
|
| |
|
Live
Fetch
Read a page by URL without opening a tab. Faster and lighter for pages that need no sign-in.
|
|
Live
Map
List a site's pages before reading them, so the agent goes straight to the ones that matter.
|
Search and Datasets work today. Fetch and Map now work in Cloud, the API and MCP, and reach the Chrome extension with version 38.3.13.
|
|
Start here
What will your first sandbox run?
Pick one job, give it its own login profile and the files it needs, and put it on a schedule. Reply to this email and tell us what you would hand it first; we read every answer.
The Retriever AI team
|
|
rtrvr.ai
Make every site work for you.
X ·
LinkedIn ·
YouTube ·
Changelog
|
|