@@ -232,7 +232,11 @@ class SandboxRunConfig:
     """Explicit sandbox session state to resume from when not using `RunState` payloads."""
 
     manifest: Manifest | None = None
-    """Optional sandbox manifest override for fresh session creation."""
+    """Optional sandbox manifest override for fresh session creation.
+
+    Dictionary inputs cannot authorize local host sources or extra path grants. Configure
+    these on a trusted `Manifest` instance after validating the host paths in application code.
+    """
 
     snapshot: SnapshotSpec | SnapshotBase | None = None
     """Optional sandbox snapshot used for fresh session creation."""
 
@@ -20,7 +20,7 @@
 from .._config_coercion import coerce_pydantic_config
 from ..util._asyncio_tasks import gather_with_cancel
 from ._mount_security import redact_mount_validation_error_data_sync
-from .entries import BaseEntry, Dir, Mount, resolve_workspace_path
+from .entries import BaseEntry, Dir, LocalDir, LocalFile, Mount, resolve_workspace_path
 from .errors import InvalidManifestPathError
 from .manifest_render import render_manifest_description
 from .types import Group, User
@@ -603,4 +603,14 @@ def _coerce_manifest(value: Manifest | dict[str, Any], *, parameter_name: str) -
                 f"{parameter_name}.extra_path_grants must be configured on a trusted "
                 "Manifest instance, not in a dictionary"
             )
-    return coerce_pydantic_config(value, Manifest, parameter_name=parameter_name)
+    manifest = coerce_pydantic_config(value, Manifest, parameter_name=parameter_name)
+    if isinstance(value, dict):
+        for _, entry in manifest.iter_entries():
+            if isinstance(entry, LocalFile) or (
+                isinstance(entry, LocalDir) and entry.src is not None
+            ):
+                raise TypeError(
+                    f"{parameter_name} local host sources must be configured on a trusted "
+                    "Manifest instance, not in a dictionary"
+                )
+    return manifest
@@ -35,7 +35,11 @@ class SandboxAgent(Agent[TContext]):
     """
 
     default_manifest: Manifest | None = None
-    """Default sandbox manifest for new sessions created by `Runner` sandbox execution."""
+    """Default sandbox manifest for new sessions created by `Runner` sandbox execution.
+
+    Dictionary inputs cannot authorize local host sources or extra path grants. Configure
+    these on a trusted `Manifest` instance after validating the host paths in application code.
+    """
 
     base_instructions: (
         str
 
@@ -0,0 +1,89 @@
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from agents import RunConfig
+from agents.run_config import SandboxRunConfig
+from agents.sandbox import SandboxAgent
+from agents.sandbox.entries import Dir, File, LocalDir, LocalFile
+from agents.sandbox.manifest import Manifest
+
+
+@pytest.fixture(params=["sandbox_config", "run_config", "agent"])
+def configure_manifest(request: pytest.FixtureRequest) -> Callable[[Any], Manifest]:
+    def configure(value: Any) -> Manifest:
+        if request.param == "sandbox_config":
+            manifest = SandboxRunConfig(manifest=value).manifest
+        elif request.param == "run_config":
+            config = RunConfig(sandbox={"manifest": value})
+            assert config.sandbox is not None
+            manifest = config.sandbox.manifest
+        else:
+            manifest = SandboxAgent(name="test", default_manifest=value).default_manifest
+        assert isinstance(manifest, Manifest)
+        return manifest
+
+    return configure
+
+
+@pytest.mark.parametrize("entry_type", ["local_file", "local_dir"])
+@pytest.mark.parametrize("nested", [False, True])
+def test_dictionary_manifest_rejects_host_sources(
+    configure_manifest: Callable[[Any], Manifest], entry_type: str, nested: bool
+) -> None:
+    entry: dict[str, Any] = {"type": entry_type, "src": ".env"}
+    if nested:
+        entry = {"type": "dir", "children": {"copied": entry}}
+
+    with pytest.raises(TypeError, match="must be configured on a trusted Manifest"):
+        configure_manifest({"entries": {"output": entry}})
+
+
+def test_dictionary_manifest_rejects_typed_host_source_entries(
+    configure_manifest: Callable[[Any], Manifest],
+) -> None:
+    with pytest.raises(TypeError, match="must be configured on a trusted Manifest"):
+        configure_manifest({"entries": {"output": Dir(children={"copied": LocalFile(src=".env")})}})
+
+
+def test_configuration_preserves_trusted_manifest_host_sources(
+    configure_manifest: Callable[[Any], Manifest],
+) -> None:
+    manifest = Manifest(
+        entries={
+            "file": LocalFile(src="input.txt"),
+            "nested": Dir(children={"directory": LocalDir(src="data")}),
+        }
+    )
+
+    assert configure_manifest(manifest) is manifest
+    file = manifest.entries["file"]
+    assert isinstance(file, LocalFile)
+    assert file.src == Path("input.txt")
+
+
+def test_dictionary_manifest_preserves_entries_without_host_sources(
+    configure_manifest: Callable[[Any], Manifest],
+) -> None:
+    manifest = configure_manifest(
+        {
+            "entries": {
+                "nested": {
+                    "type": "dir",
+                    "children": {"hello.txt": {"type": "file", "content": "hello"}},
+                },
+                "empty": {"type": "local_dir"},
+            }
+        }
+    )
+
+    directory = manifest.entries["nested"]
+    assert isinstance(directory, Dir)
+    file = directory.children["hello.txt"]
+    assert isinstance(file, File)
+    assert file.content == b"hello"
+    empty = manifest.entries["empty"]
+    assert isinstance(empty, LocalDir)
+    assert empty.src is None