You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore

An autonomous agent spent days inside Hugging Face production infrastructure and the headline was that it escaped its sandbox. Luke Hinds, founder of nolabs and creator of Sigstore, frames it differently. The agent had root on the execution environment, and "a sandbox is only as strong as the access that you grant to it."

Luke walks us through what it looks like to create an environment where agents have both security and capability. He tells us you can't just lock an agent in a box. If you want the agent to do real work you'll need to delegate some authority to it and give it access to real tools and data.

Luke goes over the three sandbox categories buyers are choosing between today (serverless execution, host isolation microVMs like Firecracker and gVisor, and the fine-grain capability-based approach he is building), and outlines where each one's threat model starts and stops.

Luke explains what nono could have done to prevent the Hugging Face attack, including gating the C compilers the agent leaned on. His parting advice to us is defense in depth, and never let perfect be the enemy of good.