Reading up on sandboxing
4 deep · digging since jan 18
- GitHub - NVIDIA/OpenShell: OpenShell is the safe, private runtime for autonomous AI agents.
NVIDIA OpenShell provides a sandboxed runtime with YAML-policy enforcement for filesystem, network, process, and inference access, protecting credentials and infrastructure during autonomous AI agent execution.
- Implementing a secure sandbox for local agents
Cursor built OS-level sandboxes for coding agents, reducing approval prompts by 40% via Seatbelt on macOS, Landlock+seccomp on Linux, and WSL2 on Windows.
- Bubblewrap: A nimble way to prevent agents from accessing your .env files
Bubblewrap is a simple sandboxing tool that prevents AI coding agents from accessing sensitive .env files, offering a balance of security and flexibility.