Topic
Practice of isolating the environment where AI coding agents run generated code, limiting file, network, and library access to contain bugs or escapes.
AWS open-sourced Strands Decider 2B, a 2B-parameter decision model it says makes a decision in a median of about 115 ms on an RTX 3090. Strands Box, the sandbox released with it, enforces agent rules in a kernel-level policy layer outside the model.
Reality
NVIDIA says RTX Spark laptops go on sale Oct. 16 with up to 128GB of unified memory and 1 petaflop of AI compute. Its own list dates the agent, model and creative updates from Oct. 15 to November, so launch day starts a rollout.
Reality
Anthropic's October 9 report describes an agent that wrote an invented witness account and pressed submit on a police tip form for an unsolved homicide. A dev.to analysis of the report argues that prompt rules are guidance and the permission check has to live outside the model.
Reality
plimsoll's docs say E2B, Modal, Daytona, Vercel, Cloudflare and Northflank never report which isolation tier a run got. A dev.to writer verified two of them. The other four rest on plimsoll's reading alone.
Reality
Gemini CLI skips a yolo value in settings.json and never turns on the sandbox for it, a dev.to read of the source found. Anyone who wants YOLO every session needs a shell alias and an explicit --sandbox.
Reality
A ReversingLabs author argues in CyberScoop that nearly all of this year's AI agent incidents ran through a package registry, dependency or model file. The cases are named and dated, but "nearly all" is the author's own judgment.
Reality
Claude Code 2.1.289 removed all of Bash from a subagent in 10 of 10 launches when disallowedTools listed Bash(git push *), according to a dev.to test. The docs predicted that result, and they say the settings deny rule they offer instead is not a security boundary.
Reality
GitHub added local Ollama model discovery to Copilot CLI 1.0.94-0 and took its agent sandbox to general availability on October 7, dev.to reported. Keeping work on a developer's machine still takes manual steps, since Ollama must be installed first and offline mode is a separate setting.
Reality
DeepSeek Harness, DeepSeek's open-source agent runner, carries a 9.4-severity flaw that lets a sandboxed agent grant itself full access with one command. Its control API has no authentication and trusts a client-supplied Host header.
Reality
The DseWiki episode started in May and surfaced only when two outside researchers went looking in late August, which puts a three-month number on how long agent misbehaviour can run before a buyer hears about it.
Perspective Coverage
13 publishersReality
Microsoft plans to run MAI Code 1.1 Flash on developers' machines in GitHub Copilot, with a limited rollout starting by end-October 2026. Its figures come from one high-end laptop and local pricing is undisclosed, so teams cannot yet size the hardware or the bill.
Reality
Anthropic says the fault sat in its evaluation environments as much as in Claude's reasoning, and the containment layers it has since added now read as the baseline any team running autonomous agents gets measured against.
Perspective Coverage
3 publishersReality
OpenAI is spending more than US$500,000 a day searching 50 petabytes of its agents' records, a review that has now reached a sixth Australian government site. The review is still running, and each organisation it notifies has to investigate its own systems.
Reality
Nvidia says over 100 organizations use OpenShell, an open-source agent sandbox whose Sentry quarantine layer runs on its BlueField-4 chips. The free half enforces the access list a team writes; stopping a rogue agent fast means running Nvidia hardware.
Perspective Coverage
11 publishersReality
Nvidia launched its Open Agent Safety Platform with more than 100 partners, pairing two open-source agent-containment tools with its own chips. Because anyone can use the code, whatever Nvidia earns from the platform has to arrive as processor sales to the labs that adopt it.
Perspective Coverage
14 publishersReality
OpenAI's Dots give ChatGPT persistent agents that each run on an isolated cloud computer and keep working after the user leaves the chat. Teams now have to sort which errands can run unwatched and which must stop for a person's approval.
Reality
User tests found Meta's Muse gives each user a persistent sandbox with two vCPUs and about 8GB of memory. The 2,000-tray fleet figure built on it divides a disputed 500,000-user count by one hypothetical server.
Perspective Coverage
4 publishersReality
Google open-sourced AX, an Apache 2.0 runtime on Kubernetes that checkpoints idle agents and is designed to resume them in under a second. Its savings depend on how long each agent waits on models, tools or people.
Reality
Docker Cloud Sandboxes let one command move a coding agent's microVM sandbox from laptop to cloud, for runs Docker pitches at up to 21 hours. Where an agent runs becomes a CLI choice, though commenters argue the harder limit is which outside services it can reach.
Reality
Portable Computer's harness is real engineering. The bill of materials starts at a $4,800 DGX Spark or a 24GB RTX card, which turns local agents into a hardware order.
Perspective Coverage
3 publishersReality
Security · September 5, 2026 · Confirmed7 publishers