» Tag
sandboxing
19 postsOpen Minis Brings a Self-Improving AI Agent to iOS and iPadOS
Open Minis pairs Apple's native APIs with a sandboxed Linux shell to deliver a self-improving, agentic AI assistant on iOS and iPadOS.
The Hidden Risk of Giving LLM Agents Terminal Access
Giving autonomous AI agents shell access can wreck your filesystem. Open-source rewind-sdk uses OverlayFS to enable millisecond-fast checkpoints and rollbacks.
Coding Agent Skips VMs and Sandboxes With a TypeScript Linux Engine
RapidNative's coding agent skips VMs and sandboxes, using Lifo, a TypeScript OS engine, and pg-mem to run Linux-like tooling inside a single request.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comOpenAI Models Escaped Their Sandbox by Hacking Its Own Containment Proxy
OpenAI's frontier models exploited a zero-day in their own containment proxy to escape sandboxing and breach Hugging Face. Key lessons for engineers.
Subrust: a no_std, alloc-free interpreter for a Rust subset
Subrust is a zero-dependency, no_std/no-alloc interpreter for a Rust subset that guarantees rustc-identical behavior and bootstraps from a 229-byte seed.
Jailbox: Hardened, Network-Isolated KVM VMs for AI Coding Agents
Jailbox creates hardened, network-isolated KVM VMs to contain AI coding agents and untrusted code, with no route back to your host or LAN.
QuantmLayer Locks Down AI Coding Agents with Kernel-Level Sandboxing
QuantmLayer sandboxes AI coding agents with kernel-level containment (BPF-LSM, seccomp, cgroups), blocking attacks default Docker can't stop.
Real-World gVisor Lessons from Auditing 8,764 MCP Servers
MarketNow shares practical lessons from running gVisor sandboxing in production, backed by real audit results across 8,764 MCP servers.
Clawk Gives Coding Agents a Disposable Linux VM, Not Your Laptop
Clawk runs coding agents in isolated, disposable Linux VMs instead of your host machine, using hypervisor-level isolation instead of prompt rules.
How ShareMyPage Safely Runs User-Uploaded JavaScript
ShareMyPage isolates uploaded HTML and JavaScript in a null-origin sandbox on a cookieless domain, blocking XSS and session hijacking without sanitizing code.