The Sandbox is a Suggestion - Deconstructing AI Agent Sandboxes

The talk starts from a practical problem: AI coding agents now run in CI/CD pipelines and background jobs, where no human approves each action and untrusted text such as issue bodies can reach the agent. The speaker argues that every agent is a model wrapped in harness code, and that a sandbox is only as good as its model of the environment it runs in. He compares three vendors' containment designs: Claude Code's permission rules, Gemini CLI's process isolation with environment stripping, and Codex CLI's kernel-enforced sandbox.

For each design, the talk shows a gap between what is claimed and what is enforced. In Claude Code's CI action, a pre-approved tools flag overrode the ask gate, and a built-in allowlist of documentation hosts let fetched URLs leak data, using a public model hub's download counter as a side channel. In Gemini CLI, secrets were removed from the child process, but the parent's environment stayed readable through procfs, and a shell command allowlist was never checked at runtime. In Codex CLI, the default Linux backend left the git directory writable, and a shared temp directory let the agent plant a symlink that the parent followed to write files outside the workspace. The speaker says each issue was reported and patched.

The takeaway is a method for evaluating any agent sandbox: identify the containment mechanism, read its enforcement code, find the assumption it depends on, and test whether the real runtime breaks that assumption. Practitioners should verify sandboxes against their own pipeline rather than trusting vendor defaults.