TechPrufer
Get started
AI Engineer
AI Engineer logoAI Engineer · Feature trail

Agentic MicroVM Sandboxing for Security

6 videos · Oct 2026

What this trail covers

This post contributes to the understanding of agentic systems by proposing an interface designed for agents that moves beyond traditional dashboards and query languages. It addresses the limitations of current Multi-Cloud Platforms (MCPs) where agents don't learn, too many tools overwhelm models, and applications are isolated. The proposed interface enables agents to work across applications by integrating tool search with execution plans, allowing for cross-app analysis and direct PR generation. This talk specifically details the failures encountered when an AI agent was tasked with stress-testing a code sandbox and cloud browser, highlighting interface-layer bugs and sandbox-layer limitations such as memory exhaustion, file permission issues, and seccomp/eBPF constraints. It emphasizes the importance of structured logging to databases and the distinction between interface and sandbox failures for robust agentic system development and security.

All AI Engineer trails
  1. 1,000 Agent Tasks in a Sandbox: What Breaks When LLMs Run Code — Kevin Orellana, AWSThis talk details the practical failures encountered when an AI coding agent was used to stress-test a code sandbox and cloud browser environment. It categorizes these failures into interface-layer bugs (e.g., image encoding, null bytes, unreadable files) and sandbox-layer limitations (e.g., memory exhaustion, file permissions, seccomp, eBPF). The contribution lies in demonstrating how an agent can be used to fuzz-test sandboxes and identify weaknesses in agentic execution environments, emphasizing the need for structured logging (SQLite) and the distinction between platform-specific issues and the underlying sandbox primitives. It also touches on the limitations of LLM-generated tests and the differences between local and remote agent environments.
  2. Why We Deleted Our MCP Server and Rebuilt It — Abhi Arya, ReductoThis post contributes to the understanding of agentic systems by detailing the failure of a 'tool for every endpoint' MCP server and proposing a rebuilt approach. The key technical contributions are: 1) Shifting from 'auto mode' to 'user-first' or 'agent experience in service of the user' to address accountability. 2) Replacing a proliferation of tools with fewer, more structured tools that carry the structure of real work. 3) Incorporating a snapshot tool for live state to provide context. 4) Making uncertainty visible via confidence scores and an agent that asks instead of guessing. 5) Implementing instrumentation that turns usage into a self-improving loop, leading to organic adoption.
  3. How I Learned to Stop Worrying and Love the Sandbox — Matt Brockman, E2BThis talk details the practical engineering challenges and solutions for managing agentic sandboxes, moving beyond theoretical interfaces to concrete operational concerns. It demonstrates how to make sandbox operations concrete through deliberately broken environments for capture-the-flag style exercises, covering resource identification (CPU, memory, disk), cleanup of runaway processes, and state preservation using templates and snapshots. The talk also addresses scaling these operations from single sandboxes to hundreds or thousands by discussing lifecycle management (idle timeouts), user-to-sandbox mapping for persistent workspaces, and filesystem caching strategies. Key takeaways include the trade-offs of state restoration and the importance of tracking resource access and cleanup.
  4. Dashboards Are Dead — Sarah Simionescu, ComposioThis talk argues that traditional dashboards are dead and proposes a new interface designed for AI agents. It highlights the shortcomings of current MCPs, specifically that agents don't learn, are overwhelmed by too many tools, and operate in isolated applications. The proposed solution integrates tool search with execution plans, enabling agents to perform cross-application analysis and directly generate fixes (e.g., PRs from Slack bug reports) without loading full results into context. This represents a shift towards building products for agents as the primary users.
  5. An Interaction Is All You Need — Ivan Leo, Google DeepMindThis talk introduces the Gemini Interactions API and Managed Agents, addressing the evolution of AI models into agents and the need for updated API designs. It details server-side state management with interaction IDs, strongly typed multimodal outputs, and the integration of built-in and custom tools. The Managed Agents feature provides persistent remote sandboxes (using the Antigravity harness) with environment IDs, loadable sources, a credential-injecting proxy, and named agents. The Gemini API CLI is also presented as an open-source tool for interacting with these capabilities. The core technical contribution is the API and infrastructure for managing complex agent workflows, including secure credential handling and persistent execution environments.
  7. YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, DockerThis post introduces Docker Sandboxes (sbx) as a solution to the security risks posed by AI agents, particularly coding agents, that can inadvertently or maliciously access sensitive host data. It demonstrates how a coding agent, given default permissions, can quickly surface browser history and financial information. The talk argues that microVMs, with their inherent isolation (kernel, filesystem, networking), provide superior security compared to harness-level guardrails. A demo showcases running an agent (Claude Code) within a sandbox, where network egress is blocked by default, preventing the agent from exfiltrating data. The system supports running any agent with a single command and previews future governance features like agent identity, delegation chains, and policy-based controls, including L7 and per-repo controls.