WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=iH_wV8BbS24

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/iH_wV8BbS24.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:01.309 --> 00:00:03.309
[music]

s2
00:00:12.840 --> 00:00:14.440
Uh my name is Robert Brennan.

s3
00:00:14.440 --> 00:00:16.480
Uh I'm the CEO at Open Hands.

s4
00:00:16.480 --> 00:00:20.800
Uh and I want to talk to you a little bit about today about uh sandboxing coding agents.

s5
00:00:20.800 --> 00:00:26.920
Uh why this is a really important pattern and uh different ways to actually get this done.

s6
00:00:27.000 --> 00:00:28.600
Uh a little bit about me.

s7
00:00:28.600 --> 00:00:38.280
Um like I said, I'm the I'm the CEO of Open Hands, uh co-founded it a little over 2 years ago, really with the vision of bringing uh coding agents to the community, right?

s8
00:00:38.280 --> 00:00:43.885
Uh really giving software developers a say in the gigantic change that's happening to our jobs.

s9
00:00:43.885 --> 00:00:43.960
[snorts]

s10
00:00:43.960 --> 00:00:47.280
Uh and we started Open Hands as an MIT licensed coding agent.

s11
00:00:47.280 --> 00:00:50.760
Uh and I would say now we've we've evolved really to a a platform for running coding agents.

s12
00:00:50.760 --> 00:00:58.440
Everything from the harness to the infrastructure to the control plane to actually like monitor these agents at scale.

s13
00:01:00.440 --> 00:01:07.320
Uh a little bit about the history of AI-driven development and how we got to where we are today and, you know, where I think things are going in the future.

s14
00:01:07.320 --> 00:01:11.280
Uh we really started with like uh code snippets being generated by a chatbot, right?

s15
00:01:11.280 --> 00:01:18.600
I remember the first time I typed in a ChatGPT like, "Write a SQL query that does X." and it just like one-shotted it and I was blown away.

s16
00:01:18.600 --> 00:01:22.440
Uh that feels very um antiquated today.

s17
00:01:22.440 --> 00:01:32.240
Um but uh you know, my my original workflow was a lot of like type in a ChatGPT, paste something into my IDE, hit enter, paste an error message back in a ChatGPT.

s18
00:01:32.240 --> 00:01:34.280
And it's pretty quick that I realized like, "Hey, this is kind of dumb.

s19
00:01:34.280 --> 00:01:36.600
I can just like wire some APIs together."

s20
00:01:36.600 --> 00:01:43.440
Uh and very quickly we got uh these AI-powered IDEs, stuff like Cursor and GitHub Copilot, doing things like autocomplete, right?

s21
00:01:43.440 --> 00:01:50.440
Where now you have the context of the code base, you're not just generating code snippets inside of a chat window, you're actually modifying the code itself.

s22
00:01:50.440 --> 00:01:52.800
You can see the variable names that are available there.

s23
00:01:52.800 --> 00:01:55.840
So, the AI gets a little bit smarter, a little bit more context-aware.

s24
00:01:55.840 --> 00:02:01.080
And then the big leap in like beginning of 2024 uh was this leap to agents.

s25
00:02:01.080 --> 00:02:06.280
So AI that wasn't just writing code, but was actually running the code that it wrote, right?

s26
00:02:06.280 --> 00:02:12.600
Actually like looking at the error messages, Googling them, really doing that entire loop of development on top of the LLM.

s27
00:02:12.600 --> 00:02:14.240
And that's kind of where we're at today.

s28
00:02:14.240 --> 00:02:23.000
I would say most developers today are still they're running something like Claude code or open hands or code acts on their laptop.

s29
00:02:23.200 --> 00:02:25.200
As a kind of a pair programmer model, right?

s30
00:02:25.200 --> 00:02:27.800
They're manually prompting this thing.

s31
00:02:27.800 --> 00:02:33.120
The leap that we're seeing organizations make over the course of 2026 is really to agents that run in the cloud.

s32
00:02:33.120 --> 00:02:36.160
And this is really where sandboxing comes into play.

s33
00:02:36.160 --> 00:02:38.880
One because you know, it needs a place to work in the cloud, right?

s34
00:02:38.880 --> 00:02:49.360
You need to give this agent a terminal, a file system, etc. But two because you're really you're able to do a lot more once you've got these agents in the cloud, right?

s35
00:02:49.360 --> 00:02:57.440
And you need to make sure that they have access only to the things that they're they're allowed to access cuz there's not necessarily going to be a human there to babysit them, right?

s36
00:02:57.440 --> 00:03:08.160
Going forward from there, I think the more we get agents running in the cloud, running autonomously, running you know, in response to events coming out of systems like GitHub and DataDog and Slack rather than being manually prompted,

s37
00:03:08.160 --> 00:03:14.080
you're going to get these interactions between agents where like one agent opens a PR, another's doing code review and they're going back and forth.

s38
00:03:14.080 --> 00:03:16.440
We see these multi-agent teams emerging.

s39
00:03:16.440 --> 00:03:22.680
And then I think the end game is really this full SDLC automation where you know, humans aren't even looking at the source code anymore.

s40
00:03:22.680 --> 00:03:33.280
But the really thing I really want to talk today about is how do we make this leap from from number three where we're running agents on our machine to number four where we've got agents running in the cloud?

s41
00:03:33.760 --> 00:03:36.440
Let's talk a little bit about running locally.

s42
00:03:36.440 --> 00:03:42.000
Who here runs Claude code on their laptop or code acts or open hands, something some local agent?

s43
00:03:42.000 --> 00:03:42.480
All right.

s44
00:03:42.480 --> 00:03:44.200
Fewer than I would expect.

s45
00:03:44.200 --> 00:03:47.880
Keep your hand raised if you use dangerously skip permissions.

s46
00:03:47.880 --> 00:03:49.239
Yeah, okay.

s47
00:03:49.239 --> 00:03:52.080
Somehow more hands than before.

s48
00:03:52.080 --> 00:03:54.880
So that the is the big trade-off when running agents locally, right?

s49
00:03:54.880 --> 00:04:10.440
Is you can either sit there and hit like yes, yes, yes, you're allowed to do that over and over again and babysit the agent while it works, or you can go into dangerously dangerous to skip permissions mode and just like trust that the agent isn't going to delete a file you really care about or access your production

s50
00:04:10.440 --> 00:04:12.640
database or anything like that, right?

s51
00:04:12.640 --> 00:04:18.160
Um, so running locally, you you are kind of limited by those those two options.

s52
00:04:18.320 --> 00:04:24.640
Uh, and if you do run locally and you run with dangerously skip permissions, uh, the agent does have access to a lot of things, right?

s53
00:04:24.640 --> 00:04:34.560
It has access to your whole local file system, uh, it has access access to any secrets that are in your environment variables, uh, it has access to any secrets that are in like in your in your home directory,

s54
00:04:34.560 --> 00:04:39.640
uh, if you're connected to like a production database or a production Kubernetes cluster, the agent can get in there.

s55
00:04:39.640 --> 00:04:42.640
It has access basically to everything that you have access to, right?

s56
00:04:42.640 --> 00:04:54.640
Um, so super important that you, uh, either sit there and babysit it and watch what it's doing or you find a way to cut off its access and really only give it access to the things that it needs.

s57
00:04:54.680 --> 00:05:01.760
And this is a this is a paradigm that we actually know well from, you know, pre-agent security days is the principle of least privilege, right?

s58
00:05:01.760 --> 00:05:07.919
The idea is that both agents and humans should only have access to the things that they need in order to do their job, right?

s59
00:05:07.919 --> 00:05:19.400
So the agent shouldn't have access to every secret on your system, it shouldn't have access to every file on your system, should only have access to the GitHub repo that it's editing and maybe a couple secrets that it needs to access a local database, something like that.

s60
00:05:19.400 --> 00:05:26.400
Um, so it's important when we start to sandbox these agents that we're looking at what exactly does this agent need in order to do its job?

s61
00:05:26.400 --> 00:05:29.880
And then we can create a sandbox that has just exactly those things.

s62
00:05:29.880 --> 00:05:42.040
And then we know that the the blast radius of a prompt injection attack, uh, or the agent getting confused, anything that could go wrong, like we we limit the blast radius by limiting how much the agent has access to.

s63
00:05:43.200 --> 00:05:49.120
So the first strategy that folks tend to experiment with is running inside of Docker containers on their laptop.

s64
00:05:49.120 --> 00:05:58.120
This is actually the way we originally launched Open Hands was as an interface where every time you started a new conversation with the agent, we'd spin up a brand new Docker container.

s65
00:05:58.120 --> 00:06:00.120
The agent would get its own its own container.

s66
00:06:00.120 --> 00:06:02.960
And this this works really nicely for several things, right?

s67
00:06:02.960 --> 00:06:03.840
One, it's ephemeral.

s68
00:06:03.840 --> 00:06:05.600
So, the agent can do kind of whatever it wants.

s69
00:06:05.600 --> 00:06:11.240
If it runs rm -rf and deletes everything, you just kill the container and start again, right?

s70
00:06:11.240 --> 00:06:14.920
It's It's a very nice The agent can can just kind of run wild.

s71
00:06:14.920 --> 00:06:17.000
You don't have to worry too much about what it's going to do.

s72
00:06:17.000 --> 00:06:25.360
And because it's running locally on your laptop, you can also mount in things selectively from your local file system, you know, like a Git repo.

s73
00:06:25.360 --> 00:06:29.320
You can mount ports so that the agent can run out an application and you can view it in your browser.

s74
00:06:29.320 --> 00:06:32.800
You can mount specific secrets and environment variables for the agent.

s75
00:06:32.800 --> 00:06:37.720
You can have MCP servers either running locally on your laptop or inside the Docker container.

s76
00:06:37.720 --> 00:06:41.320
And it's nice because the agent is still working with like your local copy of the code, right?

s77
00:06:41.320 --> 00:06:45.680
It's similar to how you're used to working where you've got like a copy of the code on your workstation.

s78
00:06:45.680 --> 00:06:50.360
And instead of you editing it, the agent's editing it now and you're deciding when to get pushed and all that.

s79
00:06:50.360 --> 00:06:52.520
But this doesn't really scale very well.

s80
00:06:52.520 --> 00:06:55.480
There's only so many Docker containers you can get running on a laptop.

s81
00:06:55.480 --> 00:07:04.960
Your laptop can't like listen for events coming out of like Slack and DataDog, etc. So, this this is pretty limited in terms of what you can do here.

s82
00:07:05.680 --> 00:07:11.600
The next strategy we see folks taking is starting to like glue together Cloud Code and GitHub Actions.

s83
00:07:11.600 --> 00:07:16.520
This is definitely different from like running Docker containers on your computer.

s84
00:07:16.520 --> 00:07:18.880
Now you're no longer working with your local copy of the code base.

s85
00:07:18.880 --> 00:07:34.080
You're now, you know, having this this agent inside of a like an ephemeral environment somewhere inside of GitHub Actions, cloning the repo, doing stuff, you know, and then like shipping it off and then everything everything goes away once that action spins down.

s86
00:07:34.480 --> 00:07:39.320
But what's nice is that, you know, you can run as many GitHub Actions as you're willing to pay for.

s87
00:07:39.320 --> 00:07:39.560
Right?

s88
00:07:39.560 --> 00:07:42.840
It has built-in in for things like a secrets registry.

s89
00:07:42.840 --> 00:07:45.360
So, you get these nice these nice isolated environments.

s90
00:07:45.360 --> 00:07:47.800
And what's really cool is now you can run them on a schedule, right?

s91
00:07:47.800 --> 00:07:53.680
You can just have a GitHub action that spins up an agent, you know, every Monday morning at 9:00 a.m. and updates your dependencies, right?

s92
00:07:53.680 --> 00:07:58.160
You can have a GitHub action that anytime a PR gets opened is going to use an agent to do code review.

s93
00:07:58.160 --> 00:08:03.200
So, you can start to get some automation in place now that the agents are are off your laptop and in the cloud.

s94
00:08:03.200 --> 00:08:05.000
But you're locked in to GitHub actions, right?

s95
00:08:05.000 --> 00:08:07.040
This is a proprietary standard.

s96
00:08:07.040 --> 00:08:09.480
You're not going to be able to really port this.

s97
00:08:09.480 --> 00:08:11.840
It's only able to respond to events coming out of GitHub, right?

s98
00:08:11.840 --> 00:08:15.800
You can't respond to like a Slack webhook or a DataDog webhook.

s99
00:08:15.800 --> 00:08:21.735
So, you're you're kind of limited in terms of what you can do by just like gluing things together with GitHub actions.

s100
00:08:21.735 --> 00:08:22.800
[snorts]

s101
00:08:22.800 --> 00:08:30.800
The next strategy we saw folks take was kind of in the open claw craze where you actually get a separate computer, you know, a virtual machine in the cloud or maybe a Mac mini

s102
00:08:30.800 --> 00:08:33.080
and just put all your agents on that, right?

s103
00:08:33.080 --> 00:08:36.760
This is different from GitHub actions in that now you've got a long-lived environment.

s104
00:08:36.760 --> 00:08:38.080
You've got persistence, right?

s105
00:08:38.080 --> 00:08:39.240
Which is good and bad, right?

s106
00:08:39.240 --> 00:08:45.680
You you your agents can modify the system and know it's going to be that way again when they run, you know, 2 days from now.

s107
00:08:45.680 --> 00:08:50.600
But your machine could get into a bad state as well and you might have to go and debug and figure out what's going on.

s108
00:08:50.600 --> 00:08:55.880
You can again you can just like in GitHub actions you can run agents on a schedule.

s109
00:08:55.880 --> 00:09:04.440
Now since if you're on a running on a VM you can actually listen for webhooks coming in from you know, Twilio if you want to listen for text messages from Slack.

s110
00:09:04.440 --> 00:09:08.839
You can listen for incidents coming out of DataDog, events coming out of GitHub.

s111
00:09:08.839 --> 00:09:11.400
So, you get agents running automatically now.

s112
00:09:11.400 --> 00:09:13.920
But you still have this principle of least privilege problem, right?

s113
00:09:13.920 --> 00:09:19.000
Where all of your agents are now like co-located in this virtual machine and they all have access to the same stuff.

s114
00:09:19.000 --> 00:09:31.800
So, you might have like a a code review agent in there alongside of you know, a DataDog triage like incident triage bot and the code review agent now for some reason has access to DataDog and there's just a lot more possibility for things to go wrong, right?

s115
00:09:31.800 --> 00:09:36.480
The code review bot can even like you know, edit the the memory for the DataDog bot.

s116
00:09:36.480 --> 00:09:44.920
So, like there's this co-locating problem quickly runs into issues where agents have access to way more than they necessarily need in order to do their job.

s117
00:09:44.920 --> 00:09:50.161
So, way more opportunities for things to go wrong when all these agents are bumping into each other.

s118
00:09:50.161 --> 00:09:51.200
[snorts]

s119
00:09:51.200 --> 00:10:00.760
The fourth and and really like the most robust strategy here, I would say is to use Kubernetes or some other like, you know, highly scalable environment that's ephemeral, right?

s120
00:10:00.760 --> 00:10:06.680
And now you're getting, you know, with Kubernetes say you get a pod for every agent session you want to run.

s121
00:10:06.680 --> 00:10:11.640
Spins up, the agent runs, does its work, you know, maybe working on a local copy of the of the repo.

s122
00:10:11.640 --> 00:10:17.000
Then it spins down and all that environment goes away, you know, the agent has opened up a pull request or something like that, right?

s123
00:10:17.000 --> 00:10:23.120
This is really nice because you don't have to worry about like the long-term state of this thing the way you do with a VM.

s124
00:10:23.120 --> 00:10:30.160
You don't have to worry about it getting into a bad state because every time an agent runs, you're you're basically killing the environment and starting fresh.

s125
00:10:30.160 --> 00:10:32.240
And you get like an infinite amount of scale, right?

s126
00:10:32.240 --> 00:10:34.320
You're you have cloud scale at this point.

s127
00:10:34.320 --> 00:10:41.280
You can run as many agents as you want as long as you're again willing to pay for the memory and CPU to run them.

s128
00:10:41.720 --> 00:10:45.320
And again, because it's it's Kubernetes, it's running in the cloud.

s129
00:10:45.320 --> 00:10:50.160
You can respond to You can run things on a schedule using cron jobs.

s130
00:10:50.160 --> 00:10:56.200
You can run things in response to HTTP events coming out of, you know, Slack and GitHub and Jira.

s131
00:10:56.200 --> 00:11:00.400
You can basically run agents fully automatically.

s132
00:11:02.320 --> 00:11:05.160
A little kind of like quick comparison here.

s133
00:11:05.160 --> 00:11:09.520
I'll just go down the the the things that I look at when I'm comparing these different strategies.

s134
00:11:09.520 --> 00:11:11.760
One is is it local or is it remote, right?

s135
00:11:11.760 --> 00:11:17.839
Is it on your on your laptop working with your copy of the code base or is it running somewhere else that has to like clone in the code itself

s136
00:11:17.839 --> 00:11:18.680
or with its own copy.

s137
00:11:18.680 --> 00:11:20.880
Those are two very different ways of working.

s138
00:11:20.880 --> 00:11:23.400
What kind of scale can you get out of this thing, right?

s139
00:11:23.400 --> 00:11:28.360
If you're if you're running locally on your laptop, you can maybe run ones of agents before things start getting uncomfortable.

s140
00:11:28.360 --> 00:11:30.800
If you're in Kubernetes, you can run thousands.

s141
00:11:30.800 --> 00:11:33.240
Level of isolation, right?

s142
00:11:33.240 --> 00:11:37.120
If you're not running if you're running like dangerously skip permissions on your laptop, you've got nothing.

s143
00:11:37.120 --> 00:11:42.880
Uh, if you've got all your agents like co-located in a VM, they're separated from your environment, but they can still step on each other's toes.

s144
00:11:42.880 --> 00:11:48.640
But something like Kubernetes, uh, every agent has its own workspace, you know, it's it's doing its own thing.

s145
00:11:48.640 --> 00:11:50.120
Uh, level of persistence.

s146
00:11:50.120 --> 00:11:55.520
Um, you know, you can you can always get some persistence by saving files out or like writing to external systems.

s147
00:11:55.520 --> 00:12:00.520
Uh, but when you're working on your laptop or you're working in a VM, you do get just like persistence by default, right?

s148
00:12:00.520 --> 00:12:02.440
That system is long-lived.

s149
00:12:02.440 --> 00:12:06.440
Um, and then what kinds of triggers can actually cause these agents to run, right?

s150
00:12:06.440 --> 00:12:10.600
If you're running locally on your laptop, it's typically just going to be a manual, you're typing in a prompt.

s151
00:12:10.600 --> 00:12:15.520
Uh, once you get into the cloud, you can start to run things on a schedule or run things in response to events.

s152
00:12:15.520 --> 00:12:24.720
Uh, if you've ever like, uh, been like biking home with your laptop open cuz you didn't want Claude code to shut down, this is a great reason to start moving your agents to the cloud.

s153
00:12:25.360 --> 00:12:30.440
Uh, I did want to, uh, touch on the fact that sandboxing is not a panacea.

s154
00:12:30.440 --> 00:12:35.040
Um, there is, uh, evidence of agents escaping their sandboxes.

s155
00:12:35.040 --> 00:12:44.520
Um, you know, here we we saw during, uh, one when Anthropic was te- testing Mythos, uh, one of the Mythos instances actually managed to break out of its sandbox,

s156
00:12:44.520 --> 00:12:46.400
gain internet access or doing other things.

s157
00:12:46.400 --> 00:12:49.240
There are container escape attacks out there.

s158
00:12:49.240 --> 00:12:53.520
Um, some of them are known if you're running an old version of Docker, say.

s159
00:12:53.520 --> 00:12:55.720
Um, so it's not it's not perfect.

s160
00:12:55.720 --> 00:12:57.640
You still have to be a little bit careful.

s161
00:12:57.640 --> 00:13:06.480
Um, but it is it is at least a a good first pass at keeping agents limited to, uh, what they're what they should be doing.

s162
00:13:07.280 --> 00:13:11.120
Um, last I'll give a quick plug for Open Hands Agent Canvas.

s163
00:13:11.120 --> 00:13:14.960
Um, this is a way, you know, really to run, uh, with any type of sandbox.

s164
00:13:14.960 --> 00:13:18.520
You can run it with Claude code or Code X or the Open Hands harness.

s165
00:13:18.520 --> 00:13:24.920
Um, but we've designed it really to, you know, by default if you saw it on your laptop, it's like running Claude code with dangerously skip permissions.

s166
00:13:24.920 --> 00:13:28.040
But with one quick toggle, you can start running things in Docker containers.

s167
00:13:28.040 --> 00:13:30.680
Another toggle, you can start running it in a remote VM.

s168
00:13:30.680 --> 00:13:33.320
Another toggle, you can run it inside of Kubernetes.

s169
00:13:33.320 --> 00:13:36.840
Um so, it's a really great way to like pick the right environment for the job.

s170
00:13:36.840 --> 00:13:37.040
Right?

s171
00:13:37.040 --> 00:13:40.160
Sometimes you really do want to be working with your local copy of the code base.

s172
00:13:40.160 --> 00:13:44.840
You want to be doing that quick iterative development back and forth with an agent where you're looking at the code locally.

s173
00:13:44.840 --> 00:13:50.520
Sometimes you really just want to fire off events that, you know, let agents run autonomously in the background for a few hours.

s174
00:13:50.520 --> 00:13:53.640
Um you really want it running inside of Kubernetes or inside of a VM.

s175
00:13:53.640 --> 00:13:58.200
Um so, this is a a great way to kind of move between these different types of environments.

s176
00:13:58.480 --> 00:14:02.760
Uh that's all I've got, but I'm happy to to take questions from the audience.

s177
00:14:04.304 --> 00:14:06.304
[applause]

s178
00:14:20.679 --> 00:14:22.679
[music]