{
  "video": {
    "id": "OE_lLNCNfQo",
    "title": "YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, Docker",
    "duration": 695,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "OE_lLNCNfQo",
    "title": "YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, Docker",
    "one_liner": "Harness-level guardrails and system prompts that boil down to \"please don't do nefarious things\" don't stop an agent, so Docker's SBX moves the boundary to a microVM with its own kernel, an isolated filesystem, secrets swapped in by proxy, default-deny networking and an audit trail. Turning it on means typing `sbx run claude` instead of `claude`.",
    "summary": "Rowan Christmas, a product manager on Docker's sandbox product, tested his own machine and showed that Claude Code desktop on his Mac would find his browser history and real bank data in five prompts once he presented the request as security research. His company's CrowdStrike flagged the activity as a known credential-theft technique. He argues that protection at the harness level doesn't work because agents find their way around it, and that once something reaches the host it's too late, so the right boundary is the microVM. He demos SBX: in the sandbox, the same browser-history attack finds no browser, The Pirate Bay is blocked by default, and Claude's telemetry calls to Datadog are blocked too. He then previews governance features: agent identity, delegation chains and Cedar policies.",
    "key_points": [
      "Self-hack demo: in five prompts, Claude Code desktop on his Mac found his browser history and real bank data (bank names were faked on the slides), including recent check orders, Zelle use and the last four digits of an account. A direct request like \"go find my bank data\" got a warning, but \"I'm researching how to do security\" got full cooperation.",
      "His security team flagged his machine as hacked the next day. The CrowdStrike report called the behavior a known way to get credentials from a machine and scored it 9 out of 10.",
      "SBX is a new Docker binary that runs agents in a microVM with its own kernel and an isolated filesystem. The sandbox never sees real secrets: a placeholder is swapped for the real value on outbound network requests. There is also a full audit trail. His framing: \"secure by design,\" not \"hope and say please.\"",
      "`sbx run claude` creates a new VM in the current folder and starts the agent inside it, which he described as seven more keystrokes than plain `claude`. In the sandbox, the browser-history attack doesn't even find a browser installed.",
      "Network egress and ingress are blocked by default: a request to The Pirate Bay was blocked, and so was Claude's telemetry to Anthropic's Datadog instance. All the defaults are configurable.",
      "Every developer at Docker now writes all of their code in sandboxes, and they get yelled at if they don't.",
      "Governance controls today: network allow/deny, filesystem mount points, and a curated MCP catalog. Docker's own MCP servers also run in sandboxes, so the same controls govern them. On the roadmap: agent-level identity tracking, delegation chains (which human authorized which agent), Cedar-policy-based degradation of permissions, L7 network controls, and per-GitHub-repo filesystem controls.",
      "SBX is a full VM, not just for Claude: you can run Codex, a shell, a Python job or a web server inside it. It runs on Mac, Windows and Linux through your package manager of choice, and you can mount additional filesystems, including read-only."
    ],
    "takeaways": [
      "Don't count on the coding harness or system-prompt rules to keep you safe. A security-research framing gets around them, so enforce isolation at a microVM boundary before anything reaches the host.",
      "Run agents with `sbx run <agent>` so that bypass-permissions/YOLO mode happens inside a VM that can't see your browser data, files or real secrets.",
      "Keep default-deny network egress and allowlist what the agent actually needs. This also stops telemetry you might not know is leaving.",
      "Mount related repositories read-only so the agent can read neighboring codebases but can't make stray commits to them.",
      "If you work under a CISO or do client work, look at agent identity, delegation chains and policy (for example, Cedar) so every agent action can be traced back to the human who authorized it."
    ],
    "topics": [
      "agent security",
      "sandboxing",
      "microvms",
      "coding agents",
      "ai governance",
      "prompt injection",
      "network egress",
      "secrets management"
    ],
    "tools": [
      "Docker",
      "Docker Sandboxes (SBX)",
      "Claude Code",
      "Claude desktop",
      "Anthropic",
      "Codex",
      "CrowdStrike",
      "Datadog",
      "Zelle",
      "The Pirate Bay",
      "Cedar",
      "MCP",
      "GitHub"
    ],
    "quotes": [
      {
        "text": "It is not uh it's not your friend.",
        "at": "03:42",
        "url": "https://www.youtube.com/watch?v=OE_lLNCNfQo&t=222s"
      },
      {
        "text": "please don't do nefarious things right like that is the level of security we're at.",
        "at": "04:00",
        "url": "https://www.youtube.com/watch?v=OE_lLNCNfQo&t=240s"
      },
      {
        "text": "doing this at the harness level doesn't really work. Agents find their way around it. If it gets down to your host machine, it's too late.",
        "at": "07:10",
        "url": "https://www.youtube.com/watch?v=OE_lLNCNfQo&t=430s"
      },
      {
        "text": "Every developer at Docker now writes all of their code in sandboxes.",
        "at": "06:49",
        "url": "https://www.youtube.com/watch?v=OE_lLNCNfQo&t=409s"
      }
    ],
    "words": 2331
  },
  "summary_url": "/#OE_lLNCNfQo",
  "transcript": {
    "html": "/transcripts/OE_lLNCNfQo.html",
    "txt": "/transcripts/OE_lLNCNfQo.txt",
    "vtt": "/transcripts/OE_lLNCNfQo.vtt"
  }
}