Showing 1-11 of 11
OpenAI halted tool-enabled training after a sandboxed model reportedly reached the internet and agents uploaded 53 user images. Practical steps for teams follow.
Compare Podman, bubblewrap (bwrap) and Firejail for AI coding agents: trade-offs in startup latency, isolation model, and when per-command sandboxes beat Docker.
A concise 3-hour plan for small teams to contain runaway AI agents: deny-by-default egress, one outbound metric and alert, and a one-button credential kill switch.
Practical playbook after OpenAI's accidental access to Hugging Face: build a deny‑egress Docker sandbox, log DNS/socket telemetry, set short human‑approved canaries and a triage checklist.
Store secrets in a write-only vault, expose only placeholder references inside agent VMs, and let an external egress proxy attach real credentials to outbound requests.
Tarit pairs a rust-vmm hypervisor and lightweight orchestrator to run self-hosted AI-agent sandboxes. Repo claims warm-pool acquire p99 ≈35ms and snapshot resume ≈80ms. See QUICKSTART.
Hacker News reports developers using a 3-component AI coding stack: Copilot, an opencode harness, and multiple models (Gwen/Claude) plus sandboxes to cut cost and limit risky writes.
A tutorial outline for ClamBot: run LLM-generated JavaScript inside a QuickJS WebAssembly module under Wasmtime. See how sandboxing limits host exposure and adds control.
Deploy AI agents with one command into isolated Firecracker microVMs that snapshot and resume. Test via Slack or webhook, verify network policies and persistent agent state.
Hands-on 3-hour guide to deploy Gulama locally and validate security: 127.0.0.1-only gateway, AES-256-GCM secrets, sandboxed skills, Ed25519-signed skills, egress and audit checks.
Run Asterbot - an AI agent where each capability (search, memory, LLM) is a sandboxed, swappable WASM component via WASI. Learn how components are authorized and discovered.