This Shit is Hard: How Chainguard is sandboxing Athena

Everyone is suddenly talking about sandboxing AI agents. Fair enough: an agent is a non-deterministic actor that writes and runs code nobody reviewed, and handing it broad tool access without a boundary is a bad week waiting to happen. Look no further than the recent incident where OpenAI’s model escaped a research environment and hacked into Hugging Face. Sure, agents need sandboxes. But running hostile code safely is a battle-tested discipline, one that an entire industry has been quietly practicing for decades. Consider the CI vendors. Their business is accepting arbitrary code from strangers and executing it on their own infrastructure, a threat model affectionately classified as "Remote Code Execution as a Service." Every CI product on the planet lives with this. They don't write the code they run, they can't review it, and some fraction of it is actively malicious. We live the same reality.…