multi-tenant level vm isolation does not solve, imho, specific issues like data exfiltration (ssh private key, api tokens) or privilege escalation, as the vm still contains the whole kernel and userspace inside. So breaking out of the vm may be a realistic scenario.
Yes of course, the secrets have to be isolated from the VMs, preferably at the network gateway and not on the same KVM host. But as far as I know there is no safer containerization technology than a VM, and the only way to be more secure would be to have a physical computer per agent process? A KVM does not use the host kernel and user space, and provides hardware level isolation (the CPU hypervisor etc), that's the point. I think that once you are inside of vm, just using firejail is the better approach, since you have more direct control over the OS level controls that are being leveraged by various container solutions anyways. At any rate, that's what I did.
If you can't isolate a computer on your network, you probably can't isolate your network from the internet, so it's an irrelevant exercise at that point. And yes, probably you can't do any of those things and any frontier model could technically hack your network, but I don't think there's a better way to do it?
Many thanks for the insight. Actually you are right, kvm provides a different level of isolation. If there is a better way to do it... Not sure about that. It seems this is somehow unexplored territory right now, and the current hype about frontier-models capable of """everything""" is difficult to fight against.
Entire VMs bring quite a lot overhead, though, I picture it as many agents being able to run in isolated environments in the very same dev laptop.
My current approach has been to use podman so far. It supports libkrun, so I may give a try to microVMs in my current project.
I am about to cry. I have been working on a project that actually made me feel I was bringing a new approach until I found this thread with an alarming number of similar tools.. I guess many of us used the same LLMs to help us building our "unique" solutions.
My approach was to remove completely docker and start using podman as rootless daemonless alternative. It also has a good solution to user-namespace mapping when I mount my repositories inside the sandbox.
I let the ai agent make changes but then I review them and push them from my host. As an alternative, you can create a ssh key pair on the host and load it into a dedicated ssh-agent, so you expose that agent socket to the agent container.
For API Tokens and similar credentials, I solved it by putting a credential broker between the podman agent container and the LLM provider.
To avoid doing any internal firewalling in the container I run a proxy as a podman container that enforces the egress policy (only https on allowed domains); so no network capabilities are required, the proxy itself handles the filtering.
Because I had the idea of using the sandboxing framework to allow specific communication inside the network (for example for pentesting), it has also (apart from the proxy mode) a "routed"-mode implemented where a podman gateway is started; this does the network filtering without holding any kernel capabilities. nftables is configured using an ephemeral container with net_admin in the same network space (one-shot network initializer).
The framework orchestrates the different required networks and Podman containers.
I haven't tried the Docker solution yet, so I'll avoid comparing them.
I have been working on my master's thesis. I am not really young anymore, so finding the time was tricky.. until I started working with AI agents. Then I started using frontier models and I couldn't sleep anymore, trying to maximize my usage limits.
The project is called Agent Sandboxing Framework. If you are interested in AI agents and security, I’d love to hear what you think.
"Stop being such a labdradoodle."
I wonder what model the author has been using to end up writing that context for Claude. Fable was pretty harsh in a couple of debugging sessions I had.
Opus 5 seemed to perform better at coding than in my short experience with prior versions. That said I cannot really compare them, as I only used them a couple of times. Last weeks I have been using mostly gpt-5.6 sol and fable. They have been helping me with my masters thesis debugging/refactoring code.
I managed to have a few sessions with fable without the safeguards triggering (bc cybersecurity project). So, my overall experience was better with gpt-5.6, also because fable noticed that the changes proposed by gpt were actually better than the ones from fable itself. I paid claude max subscription this month.
