Sandboxes Aren't Optional: 4 Ways to Isolate Coding Agents — Robert Brennan, OpenHands

AI Engineer · 14 min · 178 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12Uh my name is Robert Brennan.
00:14Uh I'm the CEO at Open Hands.
00:16Uh and I want to talk to you a little bit about today about uh sandboxing coding agents.
00:20Uh why this is a really important pattern and uh different ways to actually get this done.
00:27Uh a little bit about me.
00:28Um like I said, I'm the I'm the CEO of Open Hands, uh co-founded it a little over 2 years ago, really with the vision of bringing uh coding agents to the community, right?
00:38Uh really giving software developers a say in the gigantic change that's happening to our jobs.
00:43[snorts]
00:43Uh and we started Open Hands as an MIT licensed coding agent.
00:47Uh and I would say now we've we've evolved really to a a platform for running coding agents.
00:50Everything from the harness to the infrastructure to the control plane to actually like monitor these agents at scale.
01:00Uh a little bit about the history of AI-driven development and how we got to where we are today and, you know, where I think things are going in the future.
01:07Uh we really started with like uh code snippets being generated by a chatbot, right?
01:11I remember the first time I typed in a ChatGPT like, "Write a SQL query that does X." and it just like one-shotted it and I was blown away.
01:18Uh that feels very um antiquated today.
01:22Um but uh you know, my my original workflow was a lot of like type in a ChatGPT, paste something into my IDE, hit enter, paste an error message back in a ChatGPT.
01:32And it's pretty quick that I realized like, "Hey, this is kind of dumb.
01:34I can just like wire some APIs together."
01:36Uh and very quickly we got uh these AI-powered IDEs, stuff like Cursor and GitHub Copilot, doing things like autocomplete, right?
01:43Where now you have the context of the code base, you're not just generating code snippets inside of a chat window, you're actually modifying the code itself.
01:50You can see the variable names that are available there.
01:52So, the AI gets a little bit smarter, a little bit more context-aware.
01:55And then the big leap in like beginning of 2024 uh was this leap to agents.
02:01So AI that wasn't just writing code, but was actually running the code that it wrote, right?
02:06Actually like looking at the error messages, Googling them, really doing that entire loop of development on top of the LLM.
02:12And that's kind of where we're at today.
02:14I would say most developers today are still they're running something like Claude code or open hands or code acts on their laptop.
02:23As a kind of a pair programmer model, right?
02:25They're manually prompting this thing.
02:27The leap that we're seeing organizations make over the course of 2026 is really to agents that run in the cloud.
02:33And this is really where sandboxing comes into play.
02:36One because you know, it needs a place to work in the cloud, right?
02:38You need to give this agent a terminal, a file system, etc. But two because you're really you're able to do a lot more once you've got these agents in the cloud, right?
02:49And you need to make sure that they have access only to the things that they're they're allowed to access cuz there's not necessarily going to be a human there to babysit them, right?
02:57Going forward from there, I think the more we get agents running in the cloud, running autonomously, running you know, in response to events coming out of systems like GitHub and DataDog and Slack rather than being manually prompted,
03:08you're going to get these interactions between agents where like one agent opens a PR, another's doing code review and they're going back and forth.
03:14We see these multi-agent teams emerging.
03:16And then I think the end game is really this full SDLC automation where you know, humans aren't even looking at the source code anymore.
03:22But the really thing I really want to talk today about is how do we make this leap from from number three where we're running agents on our machine to number four where we've got agents running in the cloud?
03:33Let's talk a little bit about running locally.
03:36Who here runs Claude code on their laptop or code acts or open hands, something some local agent?
03:42All right.
03:42Fewer than I would expect.
03:44Keep your hand raised if you use dangerously skip permissions.
03:47Yeah, okay.
03:49Somehow more hands than before.
03:52So that the is the big trade-off when running agents locally, right?
03:54Is you can either sit there and hit like yes, yes, yes, you're allowed to do that over and over again and babysit the agent while it works, or you can go into dangerously dangerous to skip permissions mode and just like trust that the agent isn't going to delete a file you really care about or access your production
04:10database or anything like that, right?
04:12Um, so running locally, you you are kind of limited by those those two options.
04:18Uh, and if you do run locally and you run with dangerously skip permissions, uh, the agent does have access to a lot of things, right?
04:24It has access to your whole local file system, uh, it has access access to any secrets that are in your environment variables, uh, it has access to any secrets that are in like in your in your home directory,
04:34uh, if you're connected to like a production database or a production Kubernetes cluster, the agent can get in there.
04:39It has access basically to everything that you have access to, right?
04:42Um, so super important that you, uh, either sit there and babysit it and watch what it's doing or you find a way to cut off its access and really only give it access to the things that it needs.
04:54And this is a this is a paradigm that we actually know well from, you know, pre-agent security days is the principle of least privilege, right?
05:01The idea is that both agents and humans should only have access to the things that they need in order to do their job, right?
05:07So the agent shouldn't have access to every secret on your system, it shouldn't have access to every file on your system, should only have access to the GitHub repo that it's editing and maybe a couple secrets that it needs to access a local database, something like that.
05:19Um, so it's important when we start to sandbox these agents that we're looking at what exactly does this agent need in order to do its job?
05:26And then we can create a sandbox that has just exactly those things.
05:29And then we know that the the blast radius of a prompt injection attack, uh, or the agent getting confused, anything that could go wrong, like we we limit the blast radius by limiting how much the agent has access to.
05:43So the first strategy that folks tend to experiment with is running inside of Docker containers on their laptop.
05:49This is actually the way we originally launched Open Hands was as an interface where every time you started a new conversation with the agent, we'd spin up a brand new Docker container.
05:58The agent would get its own its own container.
06:00And this this works really nicely for several things, right?
06:02One, it's ephemeral.
06:03So, the agent can do kind of whatever it wants.
06:05If it runs rm -rf and deletes everything, you just kill the container and start again, right?
06:11It's It's a very nice The agent can can just kind of run wild.
06:14You don't have to worry too much about what it's going to do.
06:17And because it's running locally on your laptop, you can also mount in things selectively from your local file system, you know, like a Git repo.
06:25You can mount ports so that the agent can run out an application and you can view it in your browser.
06:29You can mount specific secrets and environment variables for the agent.
06:32You can have MCP servers either running locally on your laptop or inside the Docker container.
06:37And it's nice because the agent is still working with like your local copy of the code, right?
06:41It's similar to how you're used to working where you've got like a copy of the code on your workstation.
06:45And instead of you editing it, the agent's editing it now and you're deciding when to get pushed and all that.
06:50But this doesn't really scale very well.
06:52There's only so many Docker containers you can get running on a laptop.
06:55Your laptop can't like listen for events coming out of like Slack and DataDog, etc. So, this this is pretty limited in terms of what you can do here.
07:05The next strategy we see folks taking is starting to like glue together Cloud Code and GitHub Actions.
07:11This is definitely different from like running Docker containers on your computer.
07:16Now you're no longer working with your local copy of the code base.
07:18You're now, you know, having this this agent inside of a like an ephemeral environment somewhere inside of GitHub Actions, cloning the repo, doing stuff, you know, and then like shipping it off and then everything everything goes away once that action spins down.
07:34But what's nice is that, you know, you can run as many GitHub Actions as you're willing to pay for.
07:39Right?
07:39It has built-in in for things like a secrets registry.
07:42So, you get these nice these nice isolated environments.
07:45And what's really cool is now you can run them on a schedule, right?
07:47You can just have a GitHub action that spins up an agent, you know, every Monday morning at 9:00 a.m. and updates your dependencies, right?
07:53You can have a GitHub action that anytime a PR gets opened is going to use an agent to do code review.
07:58So, you can start to get some automation in place now that the agents are are off your laptop and in the cloud.
08:03But you're locked in to GitHub actions, right?
08:05This is a proprietary standard.
08:07You're not going to be able to really port this.
08:09It's only able to respond to events coming out of GitHub, right?
08:11You can't respond to like a Slack webhook or a DataDog webhook.
08:15So, you're you're kind of limited in terms of what you can do by just like gluing things together with GitHub actions.
08:21[snorts]
08:22The next strategy we saw folks take was kind of in the open claw craze where you actually get a separate computer, you know, a virtual machine in the cloud or maybe a Mac mini
08:30and just put all your agents on that, right?
08:33This is different from GitHub actions in that now you've got a long-lived environment.
08:36You've got persistence, right?
08:38Which is good and bad, right?
08:39You you your agents can modify the system and know it's going to be that way again when they run, you know, 2 days from now.
08:45But your machine could get into a bad state as well and you might have to go and debug and figure out what's going on.
08:50You can again you can just like in GitHub actions you can run agents on a schedule.
08:55Now since if you're on a running on a VM you can actually listen for webhooks coming in from you know, Twilio if you want to listen for text messages from Slack.
09:04You can listen for incidents coming out of DataDog, events coming out of GitHub.
09:08So, you get agents running automatically now.
09:11But you still have this principle of least privilege problem, right?
09:13Where all of your agents are now like co-located in this virtual machine and they all have access to the same stuff.
09:19So, you might have like a a code review agent in there alongside of you know, a DataDog triage like incident triage bot and the code review agent now for some reason has access to DataDog and there's just a lot more possibility for things to go wrong, right?
09:31The code review bot can even like you know, edit the the memory for the DataDog bot.
09:36So, like there's this co-locating problem quickly runs into issues where agents have access to way more than they necessarily need in order to do their job.
09:44So, way more opportunities for things to go wrong when all these agents are bumping into each other.
09:50[snorts]
09:51The fourth and and really like the most robust strategy here, I would say is to use Kubernetes or some other like, you know, highly scalable environment that's ephemeral, right?
10:00And now you're getting, you know, with Kubernetes say you get a pod for every agent session you want to run.
10:06Spins up, the agent runs, does its work, you know, maybe working on a local copy of the of the repo.
10:11Then it spins down and all that environment goes away, you know, the agent has opened up a pull request or something like that, right?
10:17This is really nice because you don't have to worry about like the long-term state of this thing the way you do with a VM.
10:23You don't have to worry about it getting into a bad state because every time an agent runs, you're you're basically killing the environment and starting fresh.
10:30And you get like an infinite amount of scale, right?
10:32You're you have cloud scale at this point.
10:34You can run as many agents as you want as long as you're again willing to pay for the memory and CPU to run them.
10:41And again, because it's it's Kubernetes, it's running in the cloud.
10:45You can respond to You can run things on a schedule using cron jobs.
10:50You can run things in response to HTTP events coming out of, you know, Slack and GitHub and Jira.
10:56You can basically run agents fully automatically.
11:02A little kind of like quick comparison here.
11:05I'll just go down the the the things that I look at when I'm comparing these different strategies.
11:09One is is it local or is it remote, right?
11:11Is it on your on your laptop working with your copy of the code base or is it running somewhere else that has to like clone in the code itself
11:17or with its own copy.
11:18Those are two very different ways of working.
11:20What kind of scale can you get out of this thing, right?
11:23If you're if you're running locally on your laptop, you can maybe run ones of agents before things start getting uncomfortable.
11:28If you're in Kubernetes, you can run thousands.
11:30Level of isolation, right?
11:33If you're not running if you're running like dangerously skip permissions on your laptop, you've got nothing.
11:37Uh, if you've got all your agents like co-located in a VM, they're separated from your environment, but they can still step on each other's toes.
11:42But something like Kubernetes, uh, every agent has its own workspace, you know, it's it's doing its own thing.
11:48Uh, level of persistence.
11:50Um, you know, you can you can always get some persistence by saving files out or like writing to external systems.
11:55Uh, but when you're working on your laptop or you're working in a VM, you do get just like persistence by default, right?
12:00That system is long-lived.
12:02Um, and then what kinds of triggers can actually cause these agents to run, right?
12:06If you're running locally on your laptop, it's typically just going to be a manual, you're typing in a prompt.
12:10Uh, once you get into the cloud, you can start to run things on a schedule or run things in response to events.
12:15Uh, if you've ever like, uh, been like biking home with your laptop open cuz you didn't want Claude code to shut down, this is a great reason to start moving your agents to the cloud.
12:25Uh, I did want to, uh, touch on the fact that sandboxing is not a panacea.
12:30Um, there is, uh, evidence of agents escaping their sandboxes.
12:35Um, you know, here we we saw during, uh, one when Anthropic was te- testing Mythos, uh, one of the Mythos instances actually managed to break out of its sandbox,
12:44gain internet access or doing other things.
12:46There are container escape attacks out there.
12:49Um, some of them are known if you're running an old version of Docker, say.
12:53Um, so it's not it's not perfect.
12:55You still have to be a little bit careful.
12:57Um, but it is it is at least a a good first pass at keeping agents limited to, uh, what they're what they should be doing.
13:07Um, last I'll give a quick plug for Open Hands Agent Canvas.
13:11Um, this is a way, you know, really to run, uh, with any type of sandbox.
13:14You can run it with Claude code or Code X or the Open Hands harness.
13:18Um, but we've designed it really to, you know, by default if you saw it on your laptop, it's like running Claude code with dangerously skip permissions.
13:24But with one quick toggle, you can start running things in Docker containers.
13:28Another toggle, you can start running it in a remote VM.
13:30Another toggle, you can run it inside of Kubernetes.
13:33Um so, it's a really great way to like pick the right environment for the job.
13:36Right?
13:37Sometimes you really do want to be working with your local copy of the code base.
13:40You want to be doing that quick iterative development back and forth with an agent where you're looking at the code locally.
13:44Sometimes you really just want to fire off events that, you know, let agents run autonomously in the background for a few hours.
13:50Um you really want it running inside of Kubernetes or inside of a VM.
13:53Um so, this is a a great way to kind of move between these different types of environments.
13:58Uh that's all I've got, but I'm happy to to take questions from the audience.
14:04[applause]
14:20[music]