diff --git a/net.c b/net.c
index a187a7b..d0f07d8 100644
--- a/net.c
+++ b/net.c
@@ -755,6 +755,11 @@ void net_host_device_add(Monitor *mon, const QDict *qdict)
     Error *local_err = NULL;
     QemuOpts *opts;

+#ifdef CONFIG_SECCOMP
+    fprintf(stderr, "Cannot hotplug TAP device when -sandbox is in effect\n");
+    exit(1);
+#endif
+
     if (!net_host_check_device(device)) {
         monitor_printf(mon, "invalid host network device %s\n", device);
         return;