AI agents need a sandbox, not bypass by default

A container must limit damage, not create an illusion

After incidents involving deleted disk partitions, I would not debate permission settings while an agent can still see the host at all. The central lesson is straightforward: autonomy is acceptable only inside an environment where an error cannot become the loss of a partition, secrets, or system configuration.

The discussion summary behind this note does not name an organization or the original source document. As of September 6, 2026, the dates of the incidents are also unspecified, so this should be read as an architectural analysis rather than a current product announcement. Two modes are discussed: online access after human approval and bypass permissions enabled by default.

A container alone does not solve the problem. A meaningful boundary includes running without root, dropping unnecessary Linux capabilities, using a read-only filesystem, and allowing writes only in a dedicated working directory. The summary also mentions gVisor, microVMs, Landlock, AppArmor, and SELinux-level controls to strengthen isolation.

The network deserves the same distrust as the disk. Outbound connections should reach approved services only, while credentials should be issued per task with a narrow scope and revoked afterward. Separate identities for the model, the agent controller, and tools reduce the blast radius if one layer is compromised.

I would separately inspect the container runtime socket, parent directories, mounted secrets, and any way an available tool can expand network access. Gaps like these are exactly how a container quickly stops being a sandbox and becomes a decorative box.

Bypass is useful only for pre-bounded actions

The right balance is not between complete autonomy and constant pop-up prompts. An agent can automatically read files, edit data inside its working directory, and run reversible commands when those operations are physically unable to affect the host.

File deletion, partition changes, access to secrets, system settings, and traffic outside the network allowlist should go through a policy engine and require human approval. Permission should be tied to a specific action rather than an entire session: consent for one command must not become a permanent pass.

The cost of human control is obvious: the agent works more slowly and pauses more often. But broad bypass without strict isolation merely trades convenience for a larger failure radius. Autonomy does not begin with an auto-allow button; it begins with proof that the agent has almost nothing it can break.

We previously reviewed Pydantic Monty, a secure Python interpreter for running LLM-generated code without containers. This approach helps compare environment isolation with the risks created when AI-agent permissions are bypassed.