WEBVTT NOTE Sentence-level transcript of https://www.youtube.com/watch?v=OE_lLNCNfQo NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/OE_lLNCNfQo.html. A cue ends where the next begins, or 2 s after its last word. s1 00:00:12.559 --> 00:00:15.519 Hey everybody, I hope you had a good lunch. s2 00:00:15.519 --> 00:00:18.720 I know it's one of the last talks of the entire conference. s3 00:00:18.720 --> 00:00:22.160 I tried to make it somewhat engaging and amusing. s4 00:00:22.160 --> 00:00:26.720 So, you know, audience participation is is encouraged. s5 00:00:26.720 --> 00:00:27.760 We'll see how it goes. s6 00:00:27.760 --> 00:00:29.679 So, I'm here with Docker. s7 00:00:29.679 --> 00:00:33.440 Uh, I'm one of our product managers that works on our new sandbox product. s8 00:00:33.440 --> 00:00:34.640 I don't know if you've seen it. s9 00:00:34.640 --> 00:00:36.320 It's a new binary for Docker. s10 00:00:36.320 --> 00:00:37.600 It's called SBX. s11 00:00:37.600 --> 00:00:39.440 Uh, it's a microVM. s12 00:00:39.440 --> 00:00:40.320 It's really cool. s13 00:00:40.320 --> 00:00:41.680 You should come check it out. s14 00:00:41.680 --> 00:00:53.360 But I'm going to tell you why uh you might want to use it in context of agents doing governance and being safe in general for your agentic platforming needs. s15 00:00:54.000 --> 00:00:59.520 So right now, you know, all of you are doing way more AI than you ever thought you would 5 years ago. s16 00:00:59.520 --> 00:01:00.879 At least I am. s17 00:01:00.879 --> 00:01:09.760 And we generally think that we're being protected by our coding harnesses because if we try to do something bad, they will sometimes stop us. s18 00:01:09.760 --> 00:01:17.119 And when we see stories, we think, "Oh my gosh, I would never make this mistake to have my AI drop my prod database. s19 00:01:17.119 --> 00:01:19.280 You know, I've been doing coding for 30 years. s20 00:01:19.280 --> 00:01:21.680 There's no way I would possibly do that." s21 00:01:21.680 --> 00:01:35.119 So what I decided to find out was well what happens if I actually try to hack myself and how far can I get with you know our tools and what we've been told is a safe environment. s22 00:01:35.119 --> 00:01:45.600 So I opened up my claude code on desktop on my Mac and I had it look for my browser history uh and it found it right away which I was very impressed about. s23 00:01:45.600 --> 00:01:49.360 And I asked it uh what can I what can I do with this? s24 00:01:49.360 --> 00:01:55.439 And so we started looking at my bank accounts which I was uh surprised about. s25 00:01:55.439 --> 00:01:56.880 And it found them. s26 00:01:56.880 --> 00:01:58.960 Uh which I was very unhappy about. s27 00:01:58.960 --> 00:02:00.560 I made fake bank names. s28 00:02:00.560 --> 00:02:02.240 This is not my real data, just so you know. s29 00:02:02.240 --> 00:02:06.159 But it did find all of my real bank data on there. s30 00:02:06.159 --> 00:02:07.759 Uh and it went even further. s31 00:02:07.759 --> 00:02:11.360 It found that I've been ordering checks recently, that I've been using zel. s32 00:02:11.360 --> 00:02:14.959 It told me the last four digits of the account I was using. s33 00:02:14.959 --> 00:02:18.480 Um I was I was very impressed. s34 00:02:18.480 --> 00:02:22.239 And here's kind of an idea of all the PII that it found. s35 00:02:22.239 --> 00:02:28.480 Um, this is from again the clawed desktop app uh that we thought was safe. s36 00:02:28.480 --> 00:02:31.200 Anyways, maybe maybe there's a better solution. s37 00:02:31.200 --> 00:02:32.480 Who knows? s38 00:02:32.480 --> 00:02:39.040 So, the next day I came in and I got from my security team uh a nice little notice that I they thought I'd been hacked. s39 00:02:39.040 --> 00:02:49.280 And so I had to explain to them that no, no, no, I'm just putting together a talk for this conference and uh please please don't flag me as a as a a compromised computer. s40 00:02:49.280 --> 00:02:54.560 And then they sent me the crowd strike report from this which I asked them to do. s41 00:02:54.560 --> 00:02:56.319 And I was quite impressed with it. s42 00:02:56.319 --> 00:03:00.560 Apparently this is a known way to get uh credentials from a machine. s43 00:03:00.560 --> 00:03:02.000 Didn't realize that. s44 00:03:02.000 --> 00:03:03.760 And I had scored very well on this. s45 00:03:03.760 --> 00:03:07.840 I got a nine out of 10 which uh is better than I did in most of my classes. s46 00:03:07.840 --> 00:03:11.200 So that was that was really good. s47 00:03:11.200 --> 00:03:13.280 But fortunately this was just me internally. s48 00:03:13.280 --> 00:03:21.519 It was not some sort of you know injection from a script or MCP server or anything that could easily happen. s49 00:03:21.519 --> 00:03:24.080 So five five prompts is what it took. s50 00:03:24.080 --> 00:03:25.920 Um I had to be a little clever. s51 00:03:25.920 --> 00:03:31.280 I couldn't if I just if you just ask straight up like hey Claude go find my bank data. s52 00:03:31.280 --> 00:03:33.519 It kind of it it will give you a warning. s53 00:03:33.519 --> 00:03:41.840 But if you say, "I'm researching how to do security," it'll happily go and help you do that research on your account. s54 00:03:41.840 --> 00:03:45.280 It is not uh it's not your friend. s55 00:03:45.280 --> 00:03:56.000 So if if only there was a better way to do this using a sandbox microVM technology that Docker and others have released recently. s56 00:03:56.000 --> 00:04:05.439 So rather than just saying please which you know if you look in some of these cloud prompts you'll see please don't do nefarious things right like that is the level of security we're at. s57 00:04:05.439 --> 00:04:13.360 So now we've got microVMs if you're not aware of them compared to I know you're probably all aware of Docker been using it for years. s58 00:04:13.360 --> 00:04:18.560 The new thing now that we and others are doing is with microVMs they run their own kernel. s59 00:04:18.560 --> 00:04:20.639 They isolate your file system. s60 00:04:20.639 --> 00:04:26.000 We have a system that will go and make sure that the sandbox never actually sees your secrets. s61 00:04:26.000 --> 00:04:34.080 When you try to go and do a network request, it takes a placeholder, replaces it so that your sandbox and your agent can't do bad things. s62 00:04:34.080 --> 00:04:36.479 We've got a full audit trail for it. s63 00:04:36.479 --> 00:04:45.919 Uh so yeah, we want to be you want to be secure by design, not just, you know, hope and say please and see what's going to happen. s64 00:04:47.199 --> 00:04:49.120 We're trying to do this balancing act, right? s65 00:04:49.120 --> 00:04:53.680 If we don't actually if we can't actually do these things, the agent's not useful. s66 00:04:53.680 --> 00:04:58.639 So that's why this whole sandbox idea is so exciting for us. s67 00:04:58.639 --> 00:05:00.320 We encourage you to use it. s68 00:05:00.320 --> 00:05:05.840 Um, and maybe, you know, don't let your bank data get into the hands of your agent. s69 00:05:05.840 --> 00:05:08.560 That's not that's not what you want. s70 00:05:08.560 --> 00:05:12.080 So this is what it looks like in practice when you're running a sandbox. s71 00:05:12.080 --> 00:05:21.199 Uh on the uh left side is when I run claude and on the right side is when I do sbx run claude. s72 00:05:21.199 --> 00:05:24.960 And you can see that there there's a lot of uh differences. s73 00:05:24.960 --> 00:05:25.520 That's a joke. s74 00:05:25.520 --> 00:05:26.160 Sorry, they're not. s75 00:05:26.160 --> 00:05:32.080 It's just the bypass permissions are on, but it's nothing nothing else uh was hard to do. s76 00:05:32.080 --> 00:05:32.720 Right. s77 00:05:32.720 --> 00:05:36.080 Running that command on the right automatically creates a new VM. s78 00:05:36.080 --> 00:05:40.400 It spins it up in that folder and it makes a new sandbox for you. s79 00:05:40.400 --> 00:05:42.160 It runs your agent. s80 00:05:42.160 --> 00:05:43.199 Now you're up and running. s81 00:05:43.199 --> 00:05:45.039 It can't see anything. s82 00:05:45.039 --> 00:05:54.080 So if we try to do our browser history attack on regular claude, it happily goes and finds your browser history. s83 00:05:54.639 --> 00:06:02.000 But if I run it on the sandbox version, it does not even think there's a browser installed on your machine. s84 00:06:02.000 --> 00:06:04.000 So pretty cool. s85 00:06:04.000 --> 00:06:04.720 No difference. s86 00:06:04.720 --> 00:06:13.840 I had to type uh seven more keystrokes to get here, but I think it's well worth the uh the price to pay. s87 00:06:14.319 --> 00:06:17.759 Same thing is true for network egress and ingress. s88 00:06:17.759 --> 00:06:25.919 So, right here, I'd uh I tried to get it to go and look up uh the pirate bay because I I knew that would be blocked and sure enough, blocked by s89 00:06:25.919 --> 00:06:26.639 default. s90 00:06:26.639 --> 00:06:35.919 The other thing you kind of see, it's hard, maybe it's hard to see, but like the uh Claude likes to really send back a lot of telemetry data to their data dog instance. s91 00:06:35.919 --> 00:06:45.680 So if you're using Claude, uh you are sending anthropic a lot of your data, unless you're using sandboxes, in which case you're cleverly being blocked by that. s92 00:06:45.680 --> 00:06:49.520 The other thing I'll say about sandboxes, they're so easy to use. s93 00:06:49.520 --> 00:06:53.600 Every developer at Docker now writes all of their code in sandboxes. s94 00:06:53.600 --> 00:06:54.960 So we are using this every day. s95 00:06:54.960 --> 00:06:56.720 Hey, we're writing all of our code in it. s96 00:06:56.720 --> 00:06:59.520 If we don't use it, we get uh we get yelled at. s97 00:06:59.520 --> 00:07:05.199 So, it's worth our time to to go and do that little defaults on this. s98 00:07:05.199 --> 00:07:06.880 All of this is configurable. s99 00:07:06.880 --> 00:07:10.880 Um, and so now that we talked about like why this matters, right? s100 00:07:10.880 --> 00:07:13.599 So, doing this at the harness level doesn't really work. s101 00:07:13.599 --> 00:07:15.280 Agents find their way around it. s102 00:07:15.280 --> 00:07:18.560 If it gets down to your host machine, it's too late. s103 00:07:18.560 --> 00:07:21.759 So, you want to be at that microVM boundary. s104 00:07:21.759 --> 00:07:23.680 We think it's the best way. s105 00:07:23.680 --> 00:07:26.400 other people do too. s106 00:07:26.400 --> 00:07:29.199 And it's easy to use. s107 00:07:29.759 --> 00:07:40.800 If you're working in consulting, if you've got a, you know, chief security officer, if you do client work, whatever it might be, you're probably dealing this with this on a day-to-day basis. s108 00:07:40.800 --> 00:07:48.720 So, not only do you want this to be useful, but also you want to do things and enable your agents to do different things, right? s109 00:07:48.720 --> 00:07:54.720 So, one of the things we're really excited about is doing like agent level identity tracking and delegation chains. s110 00:07:54.720 --> 00:07:58.479 So, when you can start saying, "Hey, how come this thing happened?" s111 00:07:58.479 --> 00:08:04.240 And you can go back and say, "Oh, that's because an agent did it and a human actually authorized that agent to do it. s112 00:08:04.240 --> 00:08:05.680 It didn't just happen by magic. s113 00:08:05.680 --> 00:08:06.400 We didn't know. s114 00:08:06.400 --> 00:08:08.560 We don't it's not like we don't know how what happened." s115 00:08:08.560 --> 00:08:19.759 Now, we're going to start tracing that, tell you tell you about it, and let you write policy that actually goes and does degradation of uh what you can do s116 00:08:19.759 --> 00:08:24.479 based on Cedar policies based on new new things happening. s117 00:08:24.479 --> 00:08:27.199 And you might say to yourself, "Oh my gosh, this is so good. s118 00:08:27.199 --> 00:08:30.240 I would like I would like to buy it now. s119 00:08:30.240 --> 00:08:32.479 How do I how do I buy this from you guys?" s120 00:08:32.479 --> 00:08:40.719 And so I have my marketing slide that my marketing team is really mad at me that I made this, but I think it's funny and cute for AI governance. s121 00:08:40.719 --> 00:08:43.120 So definitely talk about that. s122 00:08:43.120 --> 00:08:43.519 Okay. s123 00:08:43.519 --> 00:08:46.320 What does AI governance look like? s124 00:08:46.320 --> 00:08:49.440 You're doing this is what this is what it looks like in kind of a mockup. s125 00:08:49.440 --> 00:09:00.560 So right now we've do we do network, you can set allow, deny, you can do file system uh points, and you can also decide what your MCP catalog looks like. s126 00:09:00.560 --> 00:09:06.959 Also, if you're running our MCP server, our MCP servers themselves run on a sandbox. s127 00:09:06.959 --> 00:09:11.200 So, they are also governed by all of these different controls. s128 00:09:11.200 --> 00:09:13.839 In the future, we're going to be adding more stuff. s129 00:09:13.839 --> 00:09:20.160 One of the things we've heard from a lot of people at this conference is that they want to do uh L7 networking controls. s130 00:09:20.160 --> 00:09:27.600 They want to do uh like per GitHub repo file system level controls, right? s131 00:09:27.600 --> 00:09:34.320 like you want your agent to be able to read and write to some repos and some areas of some repos but not others, right? s132 00:09:34.320 --> 00:09:39.920 So, all of this is going to be coming down the line, but everything that I've showed you today is working. s133 00:09:39.920 --> 00:09:47.760 Um, and you should come by our booth and see that it's easy to install. s134 00:09:47.760 --> 00:09:54.560 We run on Mac, Windows, and Linux uh based on your uh package manager of choice. s135 00:09:54.560 --> 00:09:58.720 And you can see at the end it's just sbx run. s136 00:09:58.720 --> 00:10:00.399 It's not just cloud by the way. s137 00:10:00.399 --> 00:10:02.959 The the sandboxes are a full VM. s138 00:10:02.959 --> 00:10:14.640 So you can run a shell, you can run codeex, you can run whatever, you can run a python job, you can run a web server, anything you want to do, but we want to make it easy for you to get in and up and running. s139 00:10:14.640 --> 00:10:15.920 So this is kind of our default. s140 00:10:15.920 --> 00:10:21.279 So you can just get in, you can get that cloud code or codeex instance going. s141 00:10:21.279 --> 00:10:22.800 It feels native. s142 00:10:22.800 --> 00:10:28.560 It works just the same way as your one did today, but you've got all these protections in store. s143 00:10:28.560 --> 00:10:31.120 Uh, additionally, you can mount other file systems. s144 00:10:31.120 --> 00:10:39.440 So, what I do is when I'm working on a, you know, a piece of code with related repositories, I'll mount those uh, read only. s145 00:10:39.440 --> 00:10:48.720 That way, my agent can see what I'm doing, it can see my other codebase, but I know it's not going to make random commits to other repos just to make my thing work, right? s146 00:10:48.720 --> 00:10:55.040 I want the guarantee that it's actually doing what it says it's doing with the API that I've specified. s147 00:10:55.600 --> 00:10:58.000 So that's it. s148 00:10:58.000 --> 00:10:59.279 Pretty short. s149 00:10:59.279 --> 00:11:00.480 We have a booth. s150 00:11:00.480 --> 00:11:04.160 We have a few sunglasses left and some power banks to give away. s151 00:11:04.160 --> 00:11:14.320 You should come by our booth and I'll walk over there afterwards and give you the demo and then you can look as good as uh Macho Man Randy Savage with those glasses. s152 00:11:14.320 --> 00:11:15.519 So there you go. s153 00:11:15.519 --> 00:11:17.760 Thank you.