How to Configure and Manage Devin AI Sandbox File Sharing

When executing software engineering tasks, Devin AI runs shell processes inside an OS-level isolated sandbox VM, where 100% of network requests and command executions are restricted unless configured by specific domain and directory scopes [Cognition 2026]. This architectural constraint means that Devin operates within a strict sandboxed environment designed to protect the parent host from unauthorized code execution, dependency pollution, or configuration drift. Every action Devin takes, from installing package dependencies to testing local application code, is executed within a secure boundaries layer.

Developers interacting with Devin must recognize this boundary to manage files effectively. While Devin can edit files directly within its active directory, the agent cannot access folders outside the specified workspace path unless explicitly allowed. The file boundary acts as a security partition, preventing the agent from modifying or reading files on the parent machine. As a result, sharing files with Devin requires understanding how the agent accesses the sandbox, how network communication is filtered, and where outputs are stored.

This secure isolation is particularly important when Devin is running tasks that involve external APIs or proprietary code bases. By isolating the file system, the sandbox ensures that Devin cannot write to sensitive folders or execute commands that might compromise the environment. However, this partition also creates a clear distinction between the agent's active filesystem and persistent storage options, making file sharing and persistence a central part of any developer workspace setup. To bridge this gap, teams must implement file management systems that allow secure, persistent access without violating the sandbox boundaries. Using Fastio shared workspaces allows developers to coordinate their file structures across ephemeral environments.

A common question developers ask is: Is Devin AI's workspace persistent? The short answer is no, Devin's native workspace is not persistent across separate sessions. Every time a new session starts, Devin boots from a clean machine state snapshot, resetting the virtual machine to a known configuration. This approach guarantees that each task begins in a clean environment, free from left-over files, broken packages, or conflicting processes from previous runs. While this architecture is perfect for testing code and maintaining security, it means that any files, logs, or reports generated during a session will be lost when the session ends unless they are moved to a persistent storage location.

Because the local filesystem inside the sandbox is volatile, files must be moved out before the VM is shut down. When Devin completes a programming task, any files left in the sandbox directory that are not committed to a connected version control repository or stored in an external workspace will vanish. This ephemerality is a core feature of Devin's OS-level VM isolation, ensuring that the agent does not accumulate junk files or configuration state that could cause future tasks to fail.

To manage this behavior, developers must establish explicit file sharing workflows. If Devin generates a test suite, compiles a binary, or creates a database dump, those artifacts will be deleted as soon as the session closes. Therefore, configuring a reliable destination for files and datasets is necessary. Without a persistent workspace layer, developers must manually download files or rely on Devin to push changes to Git repositories, which can slow down progress and complicate handoffs between the agent and human team members.

How do I download files from Devin AI sandbox? Retrieving files from Devin's isolated environment requires explicit transfer operations. Because the workspace lacks a simple browser-based download folder for sandbox contents, developers use several structured methods to extract files.

Below is the step-by-step list of how to retrieve files from Devin's sandbox:

1. Commit and push code changes to a connected GitHub repository. Since Devin is designed to connect to version control systems, saving finished code typically involves creating a branch, committing the files, and submitting a pull request to your main repository. This is the primary method for code persistence.

2. Move logs and reports to external storage. For files that do not belong in a code repository, such as large database exports, build logs, or images, instruct Devin to upload them to a persistent shared workspace or cloud storage folder.

3. Use the Attachment API for session imports. If you need to send files into the sandbox, use Cognition's attachment endpoint to upload the files and receive a secure URL. You can then reference this URL in your prompt using the specific format ATTACHMENT:"file_url" on its own line.

4. Establish persistent outposts for long-running environments. For complex projects that require keeping intermediate files or custom package configurations across multiple sessions, run Devin on persistent virtual machine infrastructure that does not reset when the session finishes.

By using these methods, developers can ensure that their files are saved securely outside the volatile sandbox VM before the session terminates. It is helpful to establish these output paths at the start of a session, instructing the agent on where to write logs and reports so that no critical data is left behind when the virtual machine shuts down. For importing files, developers can connect their session prompts to persistent links generated by Fastio sharing portals.

Persist Devin AI files across sessions

A shared workspace with an MCP-ready endpoint for your agent's reads and writes, with versioning and search built in. Starts with a 14-day trial.

Start 14-Day Trial

When running the local agent version of Devin, file access and network permissions are configured via command-line flags and local configurations. Enforcing sandbox restrictions ensures that Devin can execute commands safely without risking the parent system's stability.

To start a session with sandbox isolation, run the CLI with the sandbox flag:

devin --sandbox

Enabling this flag forces the local agent into autonomous mode, where commands are executed within a restricted bubblewrap container on Linux or native isolation on macOS. In this mode, Devin auto-approves command executions because the sandbox protects the host system. However, direct file edits outside the sandbox still prompt for approval.

Developers configure sandbox behavior using configuration files in two locations:

• User-wide configuration: ~/.config/devin/config.json (or APPDATA/devin/config.json on Windows)
• Project-specific configuration: .devin/config.json (located in the project root directory)

For example, network access can be limited by defining allowlists and denylists inside the user-wide JSON file. Here is a typical sandbox configuration file:

{
  "sandbox": {
    "allowed_domains": [
      "github.com",
      "pypi.org",
      "fast.io"
    ],
    "denied_domains": [
      "untrustedapi.com"
    ]
  },
  "permissions": {
    "read_scopes": [
      "/Users/username/projects/devin-workspace"
    ],
    "write_scopes": [
      "/Users/username/projects/devin-workspace/output"
    ]
  }
}

By scoping the read and write paths in the local configuration file, developers prevent Devin from reading private data or writing files outside the designated workspace. Administrative settings configured by the organization always take precedence over these local files, ensuring team-wide security policies are maintained.

To prevent data loss from Devin's ephemeral sessions, developers need a persistent file management layer. Traditional alternatives include saving files to a local hard drive, pushing artifacts to Amazon S3 buckets, or copying folders to consumer cloud storage like Google Drive or Dropbox. However, these methods are often disconnected from the agent's actual runtime environment, requiring developers to write custom download scripts or manually upload files after every run.

Fastio provides a shared workspace environment designed specifically for agentic teams. Instead of separating files from the tools agents use, Fastio serves as a persistent, secure storage layer where both humans and AI agents collaborate on the same documents and datasets. You can review the Fastio pricing plans to find the best fit for your team.

Here are the key advantages of using Fastio alongside Devin AI:

• Streamable HTTP and SSE MCP servers. Fastio exposes a dedicated Model Context Protocol (MCP) server with Streamable HTTP at /mcp and legacy SSE at /sse. This lets Devin read, write, and query files directly via the MCP server, removing the need for manual file transfers. Developers can consult the Fastio persistent workspaces page to configure Devin's tool surface.

• Granular permission scopes. You can define access rights at the organization, workspace, folder, or file level. This allows developers to restrict Devin to specific folders while keeping sensitive corporate files secure.

• Per-file version history. Every file inside a Fastio workspace maintains a complete, auditable history of revisions. If Devin makes an incorrect file modification or overwrites a dataset, developers can restore prior versions, ensuring concurrent agent work remains auditable.

• Webhooks and workflow automations. Fastio features an event-driven workflow engine that supports triggers like manual runs, scheduled cron jobs, and webhooks. Developers can set up webhooks to notify external processes or run build steps whenever Devin uploads a new artifact.

• Ownership transfer. When an agent finishes setting up a workspace or generating project files, the agent account can transfer the organization to a human sponsor. The human creates a paid organization to start a 14-day trial (credit card required), and the agent transfers full ownership while maintaining administrative access.

• Collaborative Notes. Fastio Notes supports multiplayer co-editing, allowing Devin to read and update project outlines or checklist files in real time alongside human team members.

Fastio requires a paid subscription for organization workspaces. Plans include Starter ($29/mo), Business ($99/mo), and Growth ($299/mo). Every new organization begins with a 14-day trial that requires a credit card.

Rather than managing ephemeral files manually, developers can connect Devin to a persistent Fastio workspace. This setup ensures that all logs, reports, and code artifacts remain secure, versioned, and easily accessible by the entire team.