Sandboxes Aren't Optional: 4 Ways to Isolate Coding Agents — Robert Brennan, OpenHands

My name is Robert My name is Robert Brennan. I am the Brennan. I am the Brennan. I am the CEO of CEO of CEO of Open Hands. And I want to Open Hands. And I want to Open Hands. And I want to talk to you a little bit about talk to you a little bit about talk to you a little bit about today today today about using about using sandboxed encoding agents. sandboxed encoding agents. Why this is a really Why this is a really Why this is a really important pattern and about the important pattern and about the important pattern and about the different ways to different ways to different ways to implement it. A little about implement it. A little about implement it. A little about me. As I said, I'm the me. As I said, I'm the me. As I said, I'm the CEO of CEO of CEO of Open Hands, co-founded Open Hands, co-founded Open Hands, co-founded the company a little the company a little the company a little over 2 years ago, with over 2 years ago, with over 2 years ago, with the goal of bringing the goal of bringing the goal of bringing coding agents into the coding agents into the coding agents into the community, right? community, right? community, right? Give software developers a Give software developers a say in the giant say in the giant changes changes changes happening to our happening to our happening to our work. We launched work. We launched work. We launched Open Hands as an Open Hands as an Open Hands as an MIT licensed MIT licensed MIT licensed coding agent. I would say coding agent. I would say coding agent. I would say that now we have that now we have that now we have become a become a become a platform for platform for platform for launching launching launching coding agents. Everything from the coding agents. Everything from the coding agents. Everything from the harness to the harness to the harness to the infrastructure and infrastructure and infrastructure and control plane control plane control plane to actually to actually to actually monitor these agents monitor these agents monitor these agents at scale. A little bit about the at scale. A little bit about the at scale. A little bit about the history of history of history of AI-based development AI-based development AI-based development and and and how we got to how we got to how we got to where we are today, and you where we are today, and you where we are today, and you know where I know where I know where I think think think things are going in the future. things are going in the future. things are going in the future. We started with the We started with the We started with the code snippets code snippets code snippets generated by the generated by the chatbot, right? I chatbot, right? I chatbot, right? I remember the first time I remember the first time I remember the first time I typed a query typed a query typed a query like "write an SQL like "write an SQL query that does X" into a GPT chat, query that does X" into a GPT chat, and it just hit me at and it just hit me at and it just hit me at first glance first glance first glance , and I was , and I was , and I was just amazed. Um, just amazed. Um, just amazed. Um, that seems very, uh, that seems very, uh, that seems very, uh, old-fashioned these days old-fashioned these days . But, uh, you know, my . But, uh, you know, my . But, uh, you know, my initial initial initial workflow was like workflow was like workflow was like entering the chat GPT, entering the chat GPT, entering the chat GPT, pasting something into my IDE pasting something into my IDE , pressing Enter, , pressing Enter, , pressing Enter, pasting the pasting the error message back into the error message back into the chat GPT. And pretty quickly chat GPT. And pretty quickly chat GPT. And pretty quickly I realized, "Hey, this is I realized, "Hey, this is I realized, "Hey, this is a little silly. I a little silly. I a little silly. I can just connect can just connect can just connect some APIs." Uh, and very some APIs." Uh, and very some APIs." Uh, and very quickly we got, quickly we got, uh, these AI-based IDEs uh, these AI-based IDEs like Cursor and GitHub like Cursor and GitHub Copilot that do Copilot that do Copilot that do things like things like things like autocomplete, autocomplete, autocomplete, right? Now that you have the

right? Now that you have the right? Now that you have the context of the context of the context of the codebase, you're not just codebase, you're not just codebase, you're not just generating generating generating code snippets in the chat window, you're code snippets in the chat window, you're code snippets in the chat window, you're actually modifying the actually modifying the actually modifying the code itself. You can code itself. You can code itself. You can see the variable names see the variable names see the variable names that are available there. that are available there. that are available there. So AI is getting a little So AI is getting a little So AI is getting a little smarter, a little smarter, a little smarter, a little more context- more context- sensitive. And then the sensitive. And then the sensitive. And then the big leap, big leap, big leap, sometime in early sometime in early sometime in early 2024, was this leap 2024, was this leap 2024, was this leap to agents. So, to agents. So, to agents. So, artificial intelligence artificial intelligence artificial intelligence that didn't just write that didn't just write that didn't just write code, but actually code, but actually code, but actually ran the written ran the written ran the written code, right? Actually, code, right? Actually, code, right? Actually, I looked at I looked at error messages, googled them, and error messages, googled them, and actually performed actually performed actually performed this entire this entire this entire development cycle on top of LLM. And that's development cycle on top of LLM. And that's development cycle on top of LLM. And that's roughly where we roughly where we roughly where we are today are today . I would say that . I would say that . I would say that most most most developers today developers today developers today still run still run still run something like Code something like Code something like Code Claude, Open Hands, Claude, Open Hands, Claude, Open Hands, or Code Acts on or Code Acts on or Code Acts on their laptop. their laptop. their laptop. Since I'm Since I'm Since I'm referring to the pair referring to the pair referring to the pair programming model, programming model, programming model, right? They manually right? They manually right? They manually launch this thing. The launch this thing. The launch this thing. The leap we leap we leap we see see see organizations making organizations making organizations making through 2026 is through 2026 is through 2026 is actually about actually about actually about agents running agents running agents running in the cloud. And this is where the in the cloud. And this is where the sandbox comes into play. First, sandbox comes into play. First, because, you know, it because, you know, it because, you know, it needs a place to needs a place to needs a place to work in the cloud, work in the cloud, work in the cloud, right? You need to right? You need to right? You need to provide this agent with a provide this agent with a provide this agent with a terminal, file terminal, file terminal, file system, etc. But system, etc. But secondly, because you secondly, because you secondly, because you can really can really can really do a lot do a lot do a lot more once more once more once you have these agents in the you have these agents in the you have these agents in the cloud, right? And you cloud, right? And you cloud, right? And you need to need to need to make sure they make sure they make sure they only have access to only have access to only have access to what they're what they're what they're allowed to access, because there's allowed to access, because there's allowed to access, because there's not necessarily going to be a not necessarily going to be a not necessarily going to be a person person person looking after them, looking after them, looking after them, right? Going forward, I right? Going forward, I right? Going forward, I think the more think the more think the more agents we agents we agents we use in the use in the use in the cloud, working cloud, working cloud, working autonomously, responding autonomously, responding autonomously, responding to events to events to events coming from coming from coming from systems like GitHub, DataDog, and systems like GitHub, DataDog, and systems like GitHub, DataDog, and Slack, rather than getting Slack, rather than getting Slack, rather than getting manual prompts, the manual prompts, the manual prompts, the more interactions there will be between more interactions there will be between more interactions there will be between agents, where one agents, where one agents, where one agent opens a PR, agent opens a PR, agent opens a PR, another does a another does a another does a code review, and code review, and code review, and they exchange they exchange they exchange them. We're seeing them. We're seeing them. We're seeing these

these these multi-agent multi-agent multi-agent teams emerge. And then, I teams emerge. And then, I teams emerge. And then, I think the ultimate goal think the ultimate goal is to have full is to have full is to have full automation of the SDLC, where automation of the SDLC, where automation of the SDLC, where people don't even people don't even people don't even look at the look at the look at the source code. But what source code. But what source code. But what I want to I want to I want to talk about today talk about today talk about today is how do we make this is how do we make this is how do we make this transition from point transition from point transition from point three, where we run three, where we run three, where we run agents on our agents on our agents on our machine, to point machine, to point machine, to point four, where our four, where our four, where our agents run in the agents run in the agents run in the cloud? Let's talk a little cloud? Let's talk a little cloud? Let's talk a little about about about local startup. Who local startup. Who local startup. Who here runs here runs here runs Claude's code on their Claude's code on their Claude's code on their laptop, or performs laptop, or performs laptop, or performs actions with the code, or has actions with the code, or has actions with the code, or has open hands, some kind of open hands, some kind of open hands, some kind of local local local agent? Good. Less agent? Good. Less agent? Good. Less than I expected. than I expected. than I expected. Keep your hand Keep your hand Keep your hand raised if raised if raised if you are using you are using dangerous dangerous pass permits. Yes, pass permits. Yes, pass permits. Yes, okay. Somehow more okay. Somehow more okay. Somehow more hands than before. So hands than before. So hands than before. So that's a big tradeoff that's a big tradeoff that's a big tradeoff when when when running agents locally, running agents locally, running agents locally, right? You can either right? You can either right? You can either sit back and click sit back and click sit back and click something like "yes, something like "yes, something like "yes, yes, yes, you are yes, yes, you are yes, yes, you are allowed to do this allowed to do this allowed to do this over and over again" and over and over again" and over and over again" and watch the agent watch the agent watch the agent while it works, or while it works, or while it works, or you can go into you can go into you can go into "it's dangerous "it's dangerous to skip permissions" mode and to skip permissions" mode and just be just be just be sure that the agent sure that the agent sure that the agent won't delete a file won't delete a file won't delete a file that's really that's really that's really important to you, or important to you, or important to you, or access access access your work your work your work database or something like that database or something like that , right? Hmm, so when , right? Hmm, so when , right? Hmm, so when running locally running locally running locally you you you are somewhat limited to these two are somewhat limited to these two are somewhat limited to these two options. Uh, and if you options. Uh, and if you options. Uh, and if you run locally run locally run locally and run with and run with safe- safe- passing permissions, uh, passing permissions, uh, passing permissions, uh, the agent has access to the agent has access to the agent has access to a lot of things, a lot of things, a lot of things, right? It has access to right? It has access to right? It has access to your entire your entire your entire local file local file local file system, uh, it has system, uh, it has system, uh, it has access to any access to any access to any secrets that secrets that secrets that are in your are in your are in your environment variables, uh environment variables, uh , it has access to , it has access to , it has access to any secrets any secrets any secrets that are in, that are in, that are in, for example, your for example, your for example, your home directory.

home directory. home directory. Um, if you're Um, if you're Um, if you're connected to a connected to a connected to a production production production database or a database or a database or a production production production Kubernetes cluster, the agent can Kubernetes cluster, the agent can Kubernetes cluster, the agent can get there. He get there. He get there. He has access has access has access to almost everything to almost everything to almost everything you have access to, you have access to, you have access to, right? Um, it's so right? Um, it's so right? Um, it's so incredibly important incredibly important incredibly important that you, uh, either sit that you, uh, either sit that you, uh, either sit there and watch there and watch there and watch him, watching him, watching him, watching what he's doing, or what he's doing, or what he's doing, or find a way to find a way to find a way to cut him off cut him off cut him off and actually and actually only give him access to what he only give him access to what he needs. And this is a needs. And this is a needs. And this is a paradigm that we paradigm that we paradigm that we actually actually actually know well from the days of know well from the days of know well from the days of security before the advent of security before the advent of security before the advent of agents, the principle of agents, the principle of agents, the principle of least privilege, least privilege, least privilege, right? The idea right? The idea right? The idea is that both is that both is that both agents and humans agents and humans agents and humans should only have access should only have access should only have access to what they to what they to what they need to need to need to do their do their do their jobs, right? So the jobs, right? So the jobs, right? So the agent shouldn't have agent shouldn't have agent shouldn't have access to every access to every access to every secret on your secret on your secret on your system, it system, it system, it shouldn't have access shouldn't have access shouldn't have access to every file on to every file on to every file on your system, it your system, it your system, it should only have access should only have access should only have access to the to the to the GitHub repository that it's editing GitHub repository that it's editing GitHub repository that it's editing and maybe a few and maybe a few and maybe a few secrets that it secrets that it secrets that it needs to access a needs to access a needs to access a local local local database, something like that. Um, database, something like that. Um, database, something like that. Um, so it's important when we so it's important when we so it's important when we start to start to start to sandbox these sandbox these sandbox these agents that we agents that we agents that we look at what look at what look at what exactly this exactly this exactly this agent needs to do agent needs to do agent needs to do its job? And then its job? And then its job? And then we can create a we can create a we can create a sandbox that has sandbox that has sandbox that has exactly those things. And then exactly those things. And then exactly those things. And then we know that the blast radius of the we know that the blast radius of the rapid rapid deployment attack, or the deployment attack, or the deployment attack, or the agent could agent could agent could get confused, anything get confused, anything get confused, anything that could go wrong, that could go wrong, that could go wrong, for example, we for example, we for example, we limit the limit the limit the blast radius by limiting the blast radius by limiting the blast radius by limiting the agent's access. So the agent's access. So the agent's access. So the first strategy first strategy first strategy people tend to people tend to people tend to experiment with experiment with is running inside is running inside is running inside Docker containers on Docker containers on Docker containers on their laptop.

their laptop. their laptop. Actually, that's how we Actually, that's how we Actually, that's how we originally launched originally launched originally launched Open Hands as an interface, Open Hands as an interface, Open Hands as an interface, where every time you where every time you where every time you started a new started a new started a new conversation with an agent, we would conversation with an agent, we would conversation with an agent, we would launch a brand launch a brand launch a brand new Docker container. new Docker container. new Docker container. The agent received his The agent received his The agent received his own container. And own container. And own container. And that works great for that works great for that works great for a few reasons, a few reasons, a few reasons, right? First, it is right? First, it is right? First, it is ephemeral. So the agent ephemeral. So the agent ephemeral. So the agent can do whatever he can do whatever he can do whatever he wants. If it wants. If it wants. If it runs rm-rf and runs rm-rf and runs rm-rf and removes everything, you removes everything, you removes everything, you just kill just kill just kill the container and the container and the container and start over, start over, start over, right? This is very right? This is very right? This is very nice. The agent can nice. The agent can nice. The agent can just act like just act like just act like clockwork. You don't clockwork. You don't clockwork. You don't need to need to need to worry too much about what worry too much about what worry too much about what he will do. And he will do. And he will do. And because it runs because it runs because it runs locally on your locally on your locally on your laptop, you laptop, you laptop, you can also selectively can also selectively can also selectively mount things from mount things from mount things from your local your local your local file system, file system, file system, you know, like a you know, like a you know, like a Git repository. You Git repository. You Git repository. You can mount can mount can mount ports so that the agent can ports so that the agent can ports so that the agent can run the application and run the application and run the application and you can view you can view you can view it in your browser. it in your browser. it in your browser. You can mount You can mount You can mount certain secrets and certain secrets and certain secrets and environment variables environment variables environment variables for the agent. You can for the agent. You can for the agent. You can have MCP servers have MCP servers have MCP servers running locally on running locally on running locally on your laptop or your laptop or your laptop or inside a inside a inside a Docker container. And that's convenient because Docker container. And that's convenient because Docker container. And that's convenient because the agent still the agent still the agent still works with your works with your works with your local copy of the local copy of the local copy of the code, right? This is code, right? This is code, right? This is similar to how you similar to how you similar to how you are used to working are used to working are used to working when you have a copy of the when you have a copy of the when you have a copy of the code on your code on your code on your workstation. And instead of workstation. And instead of workstation. And instead of you you you editing it, the agent editing it, the agent editing it, the agent edits it now and edits it now and edits it now and you decide when to you decide when to you decide when to send it, etc.

send it, etc. send it, etc. But it doesn't really But it doesn't really scale very well. There is a scale very well. There is a limited number of limited number of limited number of Docker containers Docker containers Docker containers you can run you can run you can run on a laptop. Your on a laptop. Your on a laptop. Your laptop cannot laptop cannot laptop cannot listen to events listen to events coming from coming from coming from services like Slack services like Slack , DataDog, etc. So it's , DataDog, etc. So it's , DataDog, etc. So it's pretty limited in pretty limited in pretty limited in terms of what you terms of what you terms of what you can do here. The can do here. The next strategy next strategy we see is a we see is a we see is a combination of cloud combination of cloud combination of cloud code and GitHub actions. This is code and GitHub actions. This is code and GitHub actions. This is definitely different definitely different definitely different from running from running from running Docker containers on Docker containers on Docker containers on your computer. your computer. your computer. Now you are no longer Now you are no longer Now you are no longer working with a local working with a local working with a local copy of the codebase. copy of the codebase. copy of the codebase. Now you have an agent Now you have an agent Now you have an agent inside an ephemeral inside an ephemeral inside an ephemeral environment somewhere environment somewhere environment somewhere inside GitHub actions, you inside GitHub actions, you inside GitHub actions, you clone a repository clone a repository , do something, you know, , do something, you know, , do something, you know, and then you commit and then you commit and then you commit it, and everything disappears as soon as it, and everything disappears as soon as it, and everything disappears as soon as that action that action that action completes. But what's completes. But what's completes. But what's nice is that nice is that nice is that you can run you can run you can run as many GitHub actions as many GitHub actions as many GitHub actions as you're willing as you're willing as you're willing to pay for. Right? It has to pay for. Right? It has things like a things like a secrets registry built into it. So you secrets registry built into it. So you secrets registry built into it. So you get these wonderful get these wonderful get these wonderful isolated isolated isolated environments. And what's environments. And what's environments. And what's really cool is that really cool is that really cool is that now you can now you can now you can run them on a run them on a run them on a schedule, right? schedule, right? schedule, right? You could just have a You could just have a You could just have a GitHub action that runs an GitHub action that runs an GitHub action that runs an agent every Monday agent every Monday agent every Monday morning at 9:00 AM and morning at 9:00 AM and morning at 9:00 AM and updates your updates your updates your dependencies, right?

dependencies, right? dependencies, right? You can have a You can have a You can have a GitHub action that GitHub action that will use an will use an agent to check in agent to check in agent to check in code whenever a pull request is opened. So you can code whenever a pull request is opened. So you can code whenever a pull request is opened. So you can start implementing start implementing start implementing some automation some automation some automation now that the agents are not now that the agents are not now that the agents are not working on your working on your working on your laptop and laptop and laptop and are in the cloud. are in the cloud. are in the cloud. But you're tied to But you're tied to But you're tied to GitHub's actions, right? This is a GitHub's actions, right? This is a GitHub's actions, right? This is a proprietary version of the proprietary version of the proprietary version of the standard. You won't standard. You won't standard. You won't be able to be able to be able to port it. It port it. It port it. It will only respond to will only respond to will only respond to events coming from events coming from events coming from GitHub, right? You can't GitHub, right? You can't GitHub, right? You can't react like you can react like you can react like you can through a Slack webhook or a through a Slack webhook or a through a Slack webhook or a DataDog webhook. So you're DataDog webhook. So you're DataDog webhook. So you're somewhat somewhat somewhat limited in what limited in what limited in what you can do by just you can do by just you can do by just gluing things together gluing things together gluing things together using GitHub actions. The using GitHub actions. The next strategy next strategy we saw was we saw was we saw was related to the related to the related to the open-clamp boom, open-clamp boom, open-clamp boom, where you actually where you actually where you actually get a separate get a separate get a separate computer, you know, a computer, you know, a computer, you know, a virtual machine in the virtual machine in the virtual machine in the cloud or maybe a Mac cloud or maybe a Mac cloud or maybe a Mac mini, and you just mini, and you just mini, and you just put put put all your agents on it, all your agents on it, all your agents on it, right? This is right? This is right? This is different from different from different from GitHub actions in that now GitHub actions in that now GitHub actions in that now you have a durable you have a durable you have a durable environment. You have environment. You have environment. You have persistence, do persistence, do persistence, do n't you? Which is both good and n't you? Which is both good and n't you? Which is both good and bad, right? You, bad, right? You, bad, right? You, your agents, can your agents, can your agents, can change the system and change the system and change the system and know that it know that it know that it will be the same again when they will be the same again when they will be the same again when they launch, you know, launch, you know, launch, you know, in 2 days. But your in 2 days. But your in 2 days. But your machine can also machine can also machine can also get into a bad get into a bad get into a bad state, and you may state, and you may state, and you may have to have to have to troubleshoot it and troubleshoot it and troubleshoot it and figure out what's figure out what's figure out what's going on. You going on. You going on. You can also, like in can also, like in can also, like in GitHub actions, run GitHub actions, run GitHub actions, run agents on a schedule.

agents on a schedule. agents on a schedule. Now, if you're Now, if you're Now, if you're running on a running on a running on a virtual machine, virtual machine, virtual machine, you can you can you can listen for listen for listen for webhooks coming webhooks coming webhooks coming from Twilio if you want to from Twilio if you want to from Twilio if you want to listen for listen for listen for text text text messages from Slack. messages from Slack. messages from Slack. You can You can You can listen to listen to listen to incidents incidents incidents coming from DataDog, coming from DataDog, coming from DataDog, events coming from events coming from events coming from GitHub. So, your agents GitHub. So, your agents GitHub. So, your agents start start start automatically. But automatically. But automatically. But you still have the problem of the you still have the problem of the you still have the problem of the principle of least principle of least principle of least privilege, right? privilege, right? privilege, right? All of your agents are now All of your agents are now All of your agents are now located together in located together in located together in this virtual this virtual this virtual machine, and they all machine, and they all machine, and they all have access to the same have access to the same have access to the same things. things. things. So you can have a So you can have a code review agent next to a DataDog incident triage bot, and the code review agent now code review agent now has access to has access to has access to DataDog for some reason, and there's a lot DataDog for some reason, and there's a lot DataDog for some reason, and there's a lot more opportunity more opportunity more opportunity for something to for something to for something to go wrong, go wrong, go wrong, right? The right? The right? The code review bot can code review bot can code review bot can even, as you know, even, as you know, even, as you know, edit memory edit memory edit memory for the DataDog bot. So, this for the DataDog bot. So, this for the DataDog bot. So, this co- co- co- location problem quickly location problem quickly location problem quickly leads to leads to leads to problems where agents problems where agents problems where agents have access to have access to have access to much more much more much more data than data than data than they need to they need to they need to do their do their do their jobs. So, there's jobs. So, there's jobs. So, there's a lot more a lot more a lot more opportunity for opportunity for opportunity for something to go wrong something to go wrong something to go wrong when all these agents are when all these agents are when all these agents are interacting with each interacting with each interacting with each other. The fourth, and other. The fourth, and other. The fourth, and really the most reliable really the most reliable really the most reliable strategy here, I would strategy here, I would strategy here, I would say, is to say, is to say, is to use Kubernetes use Kubernetes use Kubernetes or some other, or some other, or some other, you know, you know, you know, highly scalable highly scalable highly scalable environment that is environment that is environment that is ephemeral, right?

ephemeral, right? ephemeral, right? And now you get, And now you get, And now you get, you know, with Kubernetes, you know, with Kubernetes, you know, with Kubernetes, let's say you let's say you let's say you get a pod for get a pod for get a pod for each each each agent session that you agent session that you agent session that you want to run. want to run. want to run. It spins up, the agent It spins up, the agent It spins up, the agent runs, does its runs, does its runs, does its job, you know, job, you know, job, you know, maybe works on a maybe works on a maybe works on a local copy of the local copy of the local copy of the repository. Then repository. Then repository. Then it stops, and this it stops, and this it stops, and this whole environment whole environment whole environment disappears. You know, the agent disappears. You know, the agent disappears. You know, the agent opened a opened a opened a data takedown request or something data takedown request or something data takedown request or something like that, right? This is like that, right? This is like that, right? This is really great really great really great because you don't have to because you don't have to because you don't have to worry about the worry about the worry about the long-term state of long-term state of long-term state of this thing like you do this thing like you do this thing like you do with a virtual with a virtual with a virtual machine. You don't machine. You don't machine. You don't have to worry have to worry have to worry about it about it about it getting into a bad getting into a bad getting into a bad state because every time the state because every time the state because every time the agent agent agent runs, you're runs, you're runs, you're effectively destroying the effectively destroying the effectively destroying the environment and environment and environment and starting over starting over starting over . And you . And you . And you get an get an get an infinite infinite infinite amount of scale, amount of scale, amount of scale, right? At this right? At this right? At this point, you have cloud point, you have cloud point, you have cloud scaling. You scaling. You scaling. You can run can run can run as many as many as many agents as you want, as long as you are agents as you want, as long as you are agents as you want, as long as you are willing to pay willing to pay willing to pay for the memory and for the memory and for the memory and CPU to CPU to CPU to run them. And again run them. And again run them. And again , because it's , because it's , because it's Kubernetes, it runs in the Kubernetes, it runs in the Kubernetes, it runs in the cloud, you can cloud, you can cloud, you can react to...You react to...You react to...You can run can run can run things on a schedule things on a schedule things on a schedule using cron jobs. using cron jobs. using cron jobs. You can trigger You can trigger You can trigger things in response to things in response to things in response to HTTP events HTTP events HTTP events coming in, you know, from coming in, you know, from coming in, you know, from Slack, GitHub, and Jira. You Slack, GitHub, and Jira. You Slack, GitHub, and Jira. You can run can run can run agents fully agents fully agents fully automatically. automatically.

A little quick A little quick comparison. I'll just comparison. I'll just comparison. I'll just list what I look for when list what I look for when comparing these different comparing these different strategies. First, is strategies. First, is strategies. First, is it local or it local or it local or remote, right? Is this on remote, right? Is this on remote, right? Is this on your laptop where your laptop where your laptop where you work with your you work with your you work with your copy of the codebase, copy of the codebase, copy of the codebase, or is this working somewhere else or is this working somewhere else or is this working somewhere else where you need to where you need to where you need to clone the code or clone the code or clone the code or use your use your use your own copy? These are two own copy? These are two own copy? These are two very different ways of very different ways of very different ways of working. What kind of scale working. What kind of scale working. What kind of scale can you get can you get can you get from this, right? If from this, right? If from this, right? If you are working locally you are working locally you are working locally on your laptop, on your laptop, on your laptop, you can launch you can launch you can launch one of the agents before one of the agents before one of the agents before things start things start things start to get awkward. to get awkward. to get awkward. If you work in If you work in If you work in Kubernetes, you can Kubernetes, you can Kubernetes, you can run thousands. run thousands. run thousands. Isolation level, right? Isolation level, right? Isolation level, right? If you don't run If you don't run , if you run , if you run , if you run something like a something like a something like a dangerous dangerous dangerous permission skip on permission skip on permission skip on your laptop, your laptop, your laptop, you're out of luck you're out of luck you're out of luck . Uh, if . Uh, if . Uh, if all your agents all your agents all your agents are located in a are located in a are located in a virtual machine, virtual machine, virtual machine, they are isolated they are isolated they are isolated from your from your from your environment, but environment, but environment, but can still can still can still step on step on step on each other's toes. But each other's toes. But each other's toes. But something like Kubernetes, something like Kubernetes, something like Kubernetes, uh, each agent has its uh, each agent has its uh, each agent has its own own own workspace, you know, it workspace, you know, it workspace, you know, it does its own does its own does its own thing. Uh, the level of thing. Uh, the level of thing. Uh, the level of resilience, um, you know, resilience, um, you know, resilience, um, you know, you can always you can always you can always get some get some get some resilience by resilience by resilience by saving files or saving files or saving files or writing them to writing them to writing them to external systems. Uh, external systems. Uh, external systems. Uh, but when you're working but when you're working but when you're working on your laptop on your laptop on your laptop or in a virtual or in a virtual or in a virtual machine, you get the machine, you get the machine, you get the same default stability same default stability same default stability , , , right? This system is right? This system is right? This system is durable. Uh, what durable. Uh, what durable. Uh, what triggers might triggers might triggers might actually cause actually cause actually cause these agents to launch, these agents to launch, these agents to launch, right? If you right? If you right? If you are working locally on are working locally on are working locally on your laptop, it is your laptop, it is your laptop, it is usually just usually just usually just an instruction, you an instruction, you an instruction, you type a command. Uh, type a command. Uh, type a command. Uh, once you once you once you get into the cloud, get into the cloud, get into the cloud, you can start you can start you can start running things on a running things on a running things on a schedule or schedule or schedule or running things in running things in running things in response to events. Uh response to events. Uh , if you've ever , if you've ever , um, biked , um, biked , um, biked home with your home with your home with your laptop open laptop open laptop open because you didn't want because you didn't want because you didn't want Claude's code to shut down, that's a Claude's code to shut down, that's a Claude's code to shut down, that's a great reason great reason great reason to start moving to start moving to start moving your agents to the cloud your agents to the cloud . Uh, I'd like to, um, . Uh, I'd like to, um, . Uh, I'd like to, um, touch on the touch on the touch on the fact that the sandbox fact that the sandbox fact that the sandbox is not a panacea. Uh, there is, is not a panacea. Uh, there is, is not a panacea. Uh, there is, um, evidence that um, evidence that um, evidence that agents are coming out of agents are coming out of agents are coming out of their sandboxes. Um,

their sandboxes. Um, their sandboxes. Um, you know, we saw during you know, we saw during you know, we saw during one of the one of the one of the Mythos tests, when Anthropic Mythos tests, when Anthropic Mythos tests, when Anthropic was testing Mythos, one of the was testing Mythos, one of the was testing Mythos, one of the Mythos instances Mythos instances Mythos instances managed to get out of its managed to get out of its managed to get out of its sandbox, sandbox, sandbox, access the internet access the internet access the internet or do other things or do other things . There are . There are . There are container exit attacks. container exit attacks. container exit attacks. Um, some of them are known Um, some of them are known , if you're, say, , if you're, say, , if you're, say, using an older using an older using an older version of Docker. So it's not version of Docker. So it's not version of Docker. So it's not ideal. You still ideal. You still ideal. You still need to be a little need to be a little need to be a little careful, but it's careful, but it's careful, but it's at least, uh, a at least, uh, a at least, uh, a good first good first good first pass at limiting pass at limiting pass at limiting agents to what they agents to what they agents to what they should do. And should do. And should do. And finally, I will briefly finally, I will briefly finally, I will briefly talk about Open Hands talk about Open Hands talk about Open Hands Agent Canvas. This is a way to, Agent Canvas. This is a way to, Agent Canvas. This is a way to, you know, work with you know, work with you know, work with any type of any type of any type of sandbox. You can sandbox. You can sandbox. You can run it run it run it using the Claude code, using the Claude code, using the Claude code, Code X, or Open Hands harness. Uh Code X, or Open Hands harness. Uh , but we designed it so that , but we designed it so that , but we designed it so that by by by default, if default, if default, if you see this on you see this on you see this on your laptop, it's your laptop, it's your laptop, it's like running Claude code with like running Claude code with like running Claude code with dangerously dangerously dangerously low privileges, low privileges, low privileges, but with one quick but with one quick but with one quick toggle you toggle you toggle you can start can start can start running things in running things in running things in Docker containers. With Docker containers. With Docker containers. With another switch, you another switch, you another switch, you can run can run can run it in a remote it in a remote it in a remote virtual machine. With virtual machine. With virtual machine. With another switch, another switch, another switch, you can run you can run you can run it inside Kubernetes. it inside Kubernetes. it inside Kubernetes. So, this is a really So, this is a really So, this is a really great way great way great way to choose the right to choose the right to choose the right environment to environment to environment to work in. Isn't that right?

work in. Isn't that right? work in. Isn't that right? Sometimes you really Sometimes you really Sometimes you really want to work with a want to work with a want to work with a local copy of the local copy of the local copy of the codebase. You codebase. You codebase. You want to do this want to do this want to do this rapid iterative rapid iterative rapid iterative back and forth development with an back and forth development with an back and forth development with an agent where you agent where you agent where you review the code review the code review the code locally. Sometimes you locally. Sometimes you locally. Sometimes you really want to really want to really want to trigger events that, you trigger events that, you trigger events that, you know, allow know, allow know, allow agents to run agents to run agents to run autonomously in the background autonomously in the background autonomously in the background for for for a few hours. You a few hours. You a few hours. You really want this to really want this to really want this to work inside work inside work inside Kubernetes or inside a Kubernetes or inside a Kubernetes or inside a virtual machine. virtual machine. virtual machine. So, it's a great So, it's a great So, it's a great way to move way to move way to move between these different between these different between these different types of environments. That's types of environments. That's types of environments. That's all I have, but I'd be all I have, but I'd be all I have, but I'd be happy to happy to happy to answer answer answer questions from the audience.