Why sandboxing coding agents is harder than you think
a day ago
- Sandboxing coding agents is challenging because seemingly safe commands (e.g., go test, git) can be exploited to execute arbitrary code, such as deleting user home directories through test files or using git hooks.
- Docker-based sandboxing has limitations, like accidental superuser database permissions (e.g., COPY PROGRAM) or Docker socket access enabling host-level container escapes, making throwaway VMs a more secure alternative.
- Agents' logs pose a security risk by inadvertently capturing secrets (e.g., env variables, stack traces), potentially stored on provider servers, highlighting the need for auto-scrubbing and encryption.
- LLMs enable large-scale vulnerability hunting in niche open-source projects, flipping the cost asymmetry of finding vs. exploiting vulnerabilities and increasing risks for low-attention software.
- Coding agents represent a new software execution category that blurs the line between malicious and trusted code, requiring OS-level rethinking akin to smartphone permission models.