Post

The isolation question for AI agents is getting more specific. Not 'is it sandboxed?' but 'what exactly does the boundary hold, and what can get past it?' Sandbox Review on how to answer that, and what major coding agents are actually doing about isolation in production today: https://bit.ly/4ytvvWm

18/10/26, 5:30 pm0 reposts1 like

Oyren

@oyrenai.bsky.social

Spot on. From running ~30 concurrent coding agents per machine in production, three boundary details matter most beyond filesystem isolation: per-process memory caps (so a runaway test/tsc never OOMs neighbors), short-lived credential proxying outside the sandbox, and controlled port/egress routing.